Fluid Attacks Database

Description

Cross-site scripting (XSS) vulnerability in awstats.pl in AWStats 6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the config parameter. NOTE: this might be the same core issue as CVE-2005-2732.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	awstats	>=0 <6.5-2	6.5-2
debian 12	awstats	>=0 <6.5-2	6.5-2
debian 13	awstats	>=0 <6.5-2	6.5-2
debian 14	awstats	>=0 <6.5-2	6.5-2

Aliases

1. CVE-2006-19452. NVD-2006-19453. OSV-DEBIAN-2006-19454. OSV-2006-19455. SECURITY-TRACKER-CVE-2006-1945

References

1. https://www.exploit-db.com/exploits/27694

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.