AWStats < 6.95 - Open Redirect

An open redirect vulnerability in awredir.pl in AWStats 6.95 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. id: CVE-2009-5020 info: name: AWStats 6.95 - Open Redirect author: pdteam severity: medium description: An open...

AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. id: CVE-2012-4547 info: name: AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting author: dhiyaneshDk severity: medium description: AWStats is prone to multip...

CLEANSTART-2023-ZT85459 Awstats version 7

Security vulnerability affects the awstats package. Awstats version 7...

CLEANSTART-2023-SM93768 In AWStats through 7

Security vulnerability affects the awstats package. In AWStats through 7...

CLEANSTART-2023-QZ96717 AWStats 7

Security vulnerability affects the awstats package. AWStats 7...

AWStats <= 7.5 - Full Path Disclosure

AWStats 7.6 contains a full path disclosure caused by improper handling of framename and update parameters in awstats.pl, letting remote attackers determine server file paths, exploit requires sending crafted parameters. id: CVE-2018-10245 info: name: AWStats = 7.5 - Full Path Disclosure author:...

AWStats - Config Path Traversal Detection (CVE-2017-1000501)

Detects CVE-2017-1000501 by requesting awstats.pl?config=../../../../../etc/passwd and matching AWStats syntax-error markers that include the traversed path. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats config path traversal CVE-2017-1000501.""" from kittysploit import from...

AWStats Totals - sort Parameter RCE (CVE-2008-3922)

Exploits CVE-2008-3922 by injecting PHP into the sort parameter of awstatstotals.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats Totals sort parameter RCE CVE-2008-3922.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

AWStats - Config File Disclosure Detection (CVE-2020-29600/35176)

Detects AWStats file/config disclosure by requesting awstats.pl?config=/etc/passwd and awstats.pl?config=passwd and looking for AWStats syntax-error warnings that echo the path CVE-2020-29600 / CVE-2020-35176. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats config file disclosure...

AWStats Totals - sort Parameter RCE Detection (CVE-2008-3922)

Detects CVE-2008-3922 by requesting awstatstotals.php?sort=.phpinfo.exit.$a and matching phpinfo output. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2008-3922 by requesting awstatstotals.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AWStats Config - Detect

AWStats configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWStats Config - Detect',...

AWStats Listing Detection

Searches for exposed awstats Internal Information. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for exposed awstats Internal Information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWStats Listing...

AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting Detection

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sa."""...

AWStats Script Config - Detect

AWStats configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWStats Script Config -...

MGASA-2026-0138 Updated awstats packages fix security vulnerability

AWStats is vulnerable to Command Injection via the open function. CVE-2025-63261...

Updated awstats packages fix security vulnerability

AWStats is vulnerable to Command Injection via the open function. CVE-2025-63261...

Fedora 44 : awstats (2026-649970e065)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-649970e065 advisory. Fix CVE-2025-63261 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

[SECURITY] Fedora 44 Update: awstats-8.0-4.fc44

Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contains, in graphical web pages. It can analyze a lot of web/wap/proxy servers...

[SECURITY] Fedora 42 Update: awstats-8.0-1.fc42

Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contains, in graphical web pages. It can analyze a lot of web/wap/proxy servers...

[SECURITY] Fedora 43 Update: awstats-8.0-2.fc43

Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contains, in graphical web pages. It can analyze a lot of web/wap/proxy servers...