Search for packages
| purl | pkg:deb/debian/awstats@7.8-2%2Bdeb11u1 |
| Next non-vulnerable version | 7.8-3+deb12u2 |
| Latest non-vulnerable version | 8.0-5 |
| Risk | 3.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-6241-45ms-x3ec
Aliases: CVE-2025-63261 |
AWStats 8.0 is vulnerable to Command Injection via the open function |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-fxrv-1bju-qkgm | In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname (omitting the initial /etc), even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501 and CVE-2020-29600. |
CVE-2020-35176
|
| VCID-s1bj-dpp3-9ubt | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. |
CVE-2022-46391
|
| VCID-vqyg-xfyk-h3e5 | In AWStats through 7.7, cgi-bin/awstats.pl?config= accepts an absolute pathname, even though it was intended to only read a file in the /etc/awstats/awstats.conf format. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000501. |
CVE-2020-29600
|