awstats awstats

Name: awstats awstats
Brand: awstats

productUS

cpe:2.3:a:awstats:awstats:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical6high15medium2low

updated 2026-10-28

vulnerabilities (26)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2005-0116US	high7.5	74.9% (100th)	Exploit	no fix	2005-01-18	≤ 6.3
CVE-2006-2237US	medium5.1	59.1% (99th)	Exploit	no fix	2006-05-08	2 versions
CVE-2010-4367US	high7.5	27.2% (98th)	Exploit	no fix	2010-12-02	33 versions
CVE-2006-3682US	medium5.0	9.46% (95th)	Exploit	no fix	2006-07-21	≤ 6.5_1.857
CVE-2005-0435US	medium5.0	7.36% (94th)	Exploit	no fix	2005-05-02	2 versions
CVE-2005-0436US	high7.5	7.02% (94th)	Exploit	no fix	2005-05-02	2 versions
CVE-2008-3714US	medium4.3	5.60% (93rd)	Exploit	no fix	2008-08-19	= 6.8
CVE-2006-1945US	low2.6	4.94% (92nd)	Exploit	no fix	2006-04-20	7 versions
CVE-2005-0438US	medium5.0	3.81% (90th)	Exploit	no fix	2005-05-02	2 versions
CVE-2017-1000501US	critical9.8	4.35% (91st)	—	no fix	2018-01-03	≤ 7.6.0
CVE-2020-29600US	critical9.8	3.84% (90th)	—	no fix	2020-12-07	≤ 7.7
CVE-2009-5020US	medium5.8	3.49% (89th)	—	no fix	2010-12-02	29 versions
CVE-2005-1527US	medium5.0	3.00% (87th)	—	no fix	2005-08-15	≤ 6.4
CVE-2006-2644US	medium4.0	2.71% (86th)	—	no fix	2006-05-30	3 versions
CVE-2010-4369US	medium6.4	2.67% (86th)	—	no fix	2010-12-02	33 versions
CVE-2010-4368US	high7.5	2.47% (84th)	—	no fix	2010-12-02	33 versions
CVE-2020-35176US	medium5.3	2.17% (82nd)	—	no fix	2020-12-12	≤ 7.8
CVE-2006-3681US	low2.6	2.09% (81st)	—	no fix	2006-07-21	≤ 6.5_1.857
CVE-2005-0363US	high7.5	1.95% (80th)	—	no fix	2005-05-02	2 versions
CVE-2018-10245US	medium5.3	1.85% (79th)	—	no fix	2018-04-20	≤ 7.6
CVE-2005-0437US	high7.5	1.80% (78th)	—	no fix	2005-05-02	2 versions
CVE-2005-0362US	medium4.6	1.79% (78th)	—	no fix	2005-02-09	14 versions
CVE-2005-2732US	medium5.0	1.74% (78th)	—	no fix	2005-08-30	≤ 6.4
CVE-2008-5080US	medium4.3	1.09% (65th)	—	no fix	2008-12-03	19 versions
CVE-2025-63261US	—	1.09% (65th)	—	no fix	2026-03-20	= 7.9
CVE-2022-46391US	medium6.1	0.71% (53rd)	—	no fix	2022-12-04	7.0 → 7.8

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor5 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')5 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')5 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')5 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')4 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')1 CVEs
CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE26 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan