CVE-2025-63261 | High | 7.8 | 2026-03-20 | AWStats 8.0 is vulnerable to Command Injection via the open function |
CVE-2022-46391 | Medium | 6.1 | 2022-12-04 | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. |
CVE-2020-35176 | Medium | 5.3 | 2020-12-12 | In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a… |
CVE-2020-29600 | Critical | 9.8 | 2020-12-07 | In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.co… |
CVE-2018-10245 | Medium | 5.3 | 2018-04-20 | A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining the full path of the… |
CVE-2017-1000501 | Critical | 9.8 | 2018-01-03 | Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in unauthenticated re… |
CVE-2010-4369 | | | 2010-12-02 | Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory. |
CVE-2010-4368 | | | 2010-12-02 | awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafte… |
CVE-2010-4367 | | | 2010-12-02 | awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configura… |
CVE-2009-5020 | | | 2010-12-02 | Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks… |
CVE-2008-5080 | | | 2008-12-03 | awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks vi… |
CVE-2008-3714 | | | 2008-08-19 | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the query_string, a di… |
CVE-2006-3682 | | | 2006-07-21 | awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode or (3) month paramet… |
CVE-2006-3681 | | | 2006-07-21 | Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script… |
CVE-2006-2644 | | | 2006-05-30 | AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to awstats.pl to upload… |
CVE-2006-2237 | | | 2006-05-08 | The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in t… |
CVE-2006-1945 | | | 2006-04-20 | Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config… |
CVE-2005-2732 | | | 2005-08-30 | AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the config parameter, whi… |
CVE-2005-1527 | | | 2005-08-15 | Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via… |
CVE-2005-0438 | | | 2005-05-02 | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter. |
CVE-2005-0437 | | | 2005-05-02 | Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via .. (dot dot) sequences in… |
CVE-2005-0436 | | | 2005-05-02 | Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the PluginMode parameter. |
CVE-2005-0435 | | | 2005-05-02 | awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to rawlog. |
CVE-2005-0363 | | | 2005-05-02 | awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter. |
CVE-2005-0362 | | | 2005-02-09 | awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadplugin", or (3) "nol… |
CVE-2005-0116 | | | 2005-01-18 | AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir parameter to aswtat… |