CVE-2008-5080

Awstats < 6.8 - XSS

Title source: rule

Description

awstats.pl in AWStats 6.8 and earlier does not properly remove quote characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the query_string parameter. NOTE: this issue exists because of an incomplete fix for CVE-2008-3714.

References (5)

Scores

EPSS 0.0040
EPSS Percentile 60.1%

Classification

CWE
CWE-79
Status published

Affected Products (20)

awstats/awstats < 6.8
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
awstats/awstats
... and 5 more

Timeline

Published Dec 03, 2008
Tracked Since Feb 18, 2026