CVE-2006-2237
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote...
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
Exploit likelihood
What each source reports
NVD Score used
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
CVE-2006-2237- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
CVE-2006-2237- Updated
- 2026-11-02
EUVDEUVD-2006-2238 No score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
EUVD-2006-2238- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x4mq-2mhg-3c5x No score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote...
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
GHSA-x4mq-2mhg-3c5x- Updated
- 2026-11-02
OSV No score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
CVE-2006-2237- Updated
- 2026-11-02
OSVDEBIAN-CVE-2006-2237 No score
The web interface for AWStats 6.4 and 6.5, when statistics updates are enabled, allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.
- Record
DEBIAN-CVE-2006-2237- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | AWStats 6.4 < 6.5 - migrate Remote Command Execution (Metasploit) | 2010-07-03 |
| Exploit-DB | AWStats 6.5 - 'migrate' Remote Shell Command Injection | 2006-05-06 |
| Exploit-DB | AWStats 6.4 < 6.5 - AllowToUpdateStatsFromBrowser Command Injection (Metasploit) | 2006-05-04 |
| Metasploit | AWStats migrate Remote Command Execution | 2006-05-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2237 is a medium vulnerability (CVSS 5.1) in Awstats, published May 8, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 59.1%, the 99th percentile. Fixed in awstats 6.5-2.
References
secunia.com/advisories/20710
awstats.sourceforge.net/awstats_security_news.php
debian.org/security/2006/dsa-1058
exchange.xforce.ibmcloud.com/vulnerabilities/26287
Show 13 moreShow less
vupen.com/english/advisories/2006/1678
osreviews.net/reviews/comm/awstats
osvdb.org/25284
usn.ubuntu.com/285-1
vuxml.org/freebsd/2df297a2-dc74-11da-a22b-000c6ec775d9.html
security.gentoo.org/glsa/glsa-200606-06.xml
novell.com/linux/security/advisories/2006_33_awstats.html
securityfocus.com/bid/17844
nvd.nist.gov/vuln/detail/CVE-2006-2237
github.com/advisories/GHSA-x4mq-2mhg-3c5x
security-tracker.debian.org/tracker/CVE-2006-2237