CVE-2005-1527: Awstats

Medium severity, CVSS 5.0. EPSS: 3% chance of exploitation in the next 30 days.

Eval injection vulnerability in awstats.pl in AWStats 6.4 and earlier, when a URLPlugin is enabled, allows remote attackers to execute arbitrary Perl code via the HTTP Referrer, which is used in a $url parameter that is inserted into an eval function call.

Affected products

• Awstats Awstats: up to and including 6.4
• Canonical Ubuntu Linux: version 5.04 only
• Debian Debian Linux: version 3.0 only; version 3.1 only

Published 2005-08-15. Last modified 2026-06-16.