Skip to content
Noroxi

awstats records

26 published records for vendor awstats.

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 7.7%
Pre-auth RCE
8
With a fix record
88.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 22
  4. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

26 records
  • CVE-2005-0116
    52Plan

    AWStats 6.1, and other versions before 6.3, allows remote attackers to execute arbitrary commands via shell metacharacters in the configdir

    HighCVSS 7.5WeaponizedEPSS 74%

    awstats · awstatsJan 18, 2005

  • CVE-2006-2237
    40Plan

    The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell

    MediumCVSS 5.1WeaponizedEPSS 58%

    awstats · awstatsMay 8, 2006

  • CVE-2017-1000501
    40Plan

    Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the "config" and "migrate" parameters resulting in

    CriticalCVSS 9.8No exploitEPSS 4%

    awstats · awstatsJan 3, 2018

  • CVE-2020-29600
    40Plan

    In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc

    CriticalCVSS 9.8No exploitEPSS 3%

    awstats · awstatsDec 7, 2020

  • CVE-2010-4367
    38Monitor

    awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via

    HighCVSS 7.5Proof of conceptEPSS 27%

    awstats · awstatsDec 2, 2010

  • CVE-2005-0436
    32Monitor

    Direct code injection vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to execute portions of Perl code via the Pl

    HighCVSS 7.5Proof of conceptEPSS 7%

    awstats · awstatsMay 2, 2005

  • CVE-2010-4368
    31Monitor

    awstats.cgi in AWStats before 7.0 on Windows accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary co

    HighCVSS 7.5No exploitEPSS 2%

    awstats · awstatsDec 2, 2010

  • CVE-2005-0363
    31Monitor

    awstats.pl in AWStats 4.0 and 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the config parameter.

    HighCVSS 7.5No exploitEPSS 1%

    awstats · awstatsMay 2, 2005

  • CVE-2005-0437
    31Monitor

    Directory traversal vulnerability in awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to include arbitrary Perl modules via ..

    HighCVSS 7.5No exploitEPSS 1%

    awstats · awstatsMay 2, 2005

  • CVE-2025-63261
    31Monitor

    AWStats 8.0 is vulnerable to Command Injection via the open function

    HighCVSS 7.8No exploitEPSS 1%

    awstats · awstatsMar 20, 2026

  • CVE-2010-4369
    26Monitor

    Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin direc

    MediumCVSS 6.4No exploitEPSS 2%

    awstats · awstatsDec 2, 2010

  • CVE-2009-5020
    24Monitor

    Open redirect vulnerability in awredir.pl in AWStats before 6.95 allows remote attackers to redirect users to arbitrary web sites and conduc

    MediumCVSS 5.8Proof of conceptEPSS 3%

    awstats · awstatsDec 2, 2010

  • CVE-2022-46391
    24Monitor

    AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.

    MediumCVSS 6.1No exploitEPSS 0%

    awstats · awstatsDec 3, 2022

  • CVE-2006-3682
    23Monitor

    awstats.pl in AWStats 6.5 build 1.857 and earlier allows remote attackers to obtain the installation path via the (1) year, (2) pluginmode o

    MediumCVSS 5.0Proof of conceptEPSS 9%

    awstats · awstatsJul 21, 2006

  • CVE-2005-0435
    22Monitor

    awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to read server web logs by setting the loadplugin and pluginmode parameters to raw

    MediumCVSS 5.0Proof of conceptEPSS 7%

    awstats · awstatsMay 2, 2005

  • CVE-2020-35176
    22Monitor

    In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was inten

    MediumCVSS 5.3No exploitEPSS 2%

    awstats · awstatsDec 11, 2020

  • CVE-2018-10245
    22Monitor

    A Full Path Disclosure vulnerability in AWStats through 7.6 allows remote attackers to know where the config file is allocated, obtaining th

    MediumCVSS 5.3Proof of conceptEPSS 1%

    awstats · awstatsApr 20, 2018

  • CVE-2005-0438
    21Monitor

    awstats.pl in AWStats 6.3 and 6.4 allows remote attackers to obtain sensitive information by setting the debug parameter.

    MediumCVSS 5.0Proof of conceptEPSS 3%

    awstats · awstatsMay 2, 2005

  • CVE-2005-1527
    21Monitor

    Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbit

    MediumCVSS 5.0No exploitEPSS 3%

    awstats · awstatsAug 15, 2005

  • CVE-2005-2732
    21Monitor

    AWStats 6.4, and possibly earlier versions, allows remote attackers to obtain sensitive information via a file that does not exist in the co

    MediumCVSS 5.0No exploitEPSS 1%

    awstats · awstatsAug 30, 2005

  • CVE-2008-3714
    19Monitor

    Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.8 allows remote attackers to inject arbitrary web script or HTML via the

    MediumCVSS 4.3Proof of conceptEPSS 5%

    awstats · awstatsAug 19, 2008

  • CVE-2005-0362
    19Monitor

    awstats.pl in AWStats 6.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) "pluginmode", (2) "loadp

    MediumCVSS 4.6No exploitEPSS 1%

    awstats · awstatsFeb 9, 2005

  • CVE-2006-2644
    17Monitor

    AWStats 6.5, and possibly other versions, allows remote authenticated users to execute arbitrary code by using the configdir parameter to aw

    MediumCVSS 4.0No exploitEPSS 2%

    awstats · awstatsMay 30, 2006

  • CVE-2008-5080
    17Monitor

    awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripti

    MediumCVSS 4.3No exploitEPSS 1%

    awstats · awstatsDec 3, 2008

  • CVE-2006-1945
    11Monitor

    Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or

    LowCVSS 2.6Proof of conceptEPSS 4%

    awstats · awstatsApr 20, 2006