CVE-2022-46391: Awstats

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks.

Affected products

• Awstats Awstats: from 7.0, up to and including 7.8
• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 36 only; version 37 only

Published 2022-12-04. Last modified 2026-06-17.