CVE catalog

CVE-2006-3681

awstats: CVE-2006-3681

[CVE catalog]

Severity
Low
Published
Source
[NVD] · [CVE record]
EPSS
2.09% · Oct 25, 2026

Multiple cross-site scripting (XSS) vulnerabilities in awstats.pl in AWStats 6.5 build 1.857 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) refererpagesfilter, (2) refererpagesfilterex, (3) urlfilterex, (4) urlfilter, (5) hostfilter, or (6) hostfilterex parameters, a different set of vectors than CVE-2006-1945.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianawstatssid8.0-5fixed
Debianawstatsforky8.0-5fixed
Debianawstatstrixie7.9-1+deb13u2fixed
Debianawstatsbookworm7.8-3+deb12u2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianawstatssourcesid6.5-2unimportantNot reported[378960]
Debianawstatssourceforky6.5-2unimportantNot reported[378960]
Debianawstatssourcetrixie6.5-2unimportantNot reported[378960]
Debianawstatssourcebookworm6.5-2unimportantNot reported[378960]

[Debian bug #378960]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [awstats]Fixed
    Details (2)

    • 7.8-3+deb12u2 · all · bookworm

      Fixed · Fixed: 6.5-2

      dsa · awstats · debian · bookworm; dsa · awstats · debian · 12

    • 7.8-3+deb12u2 · all · bookworm

      Fixed · Fixed: 6.5-2

      dsa · awstats · debian · bookworm; dsa · awstats · debian · 12

[Debian 13 (Trixie)]

  • [awstats]Fixed
    Details (2)

    • 7.9-1+deb13u2 · all · trixie

      Fixed · Fixed: 6.5-2

      dsa · awstats · debian · 13

    • 7.9-1+deb13u2 · all · trixie

      Fixed · Fixed: 6.5-2

      dsa · awstats · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]