{"id":"CVE-2017-20099","aliases":["EUVD-2017-11106","GHSA-36vr-cpp3-vrwf"],"status":"published","title":"Analytics Stats Counter Statistics Plugin code injection","description":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01174,"percentile":0.67732,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2022-06-27T18:11:03Z","modified":"2026-06-17T01:15:10Z","products":[{"vendor":"analytics_stats_counter_statistics_project","product":"analytics_stats_counter_statistics"},{"vendor":"unspecified","product":"analytics stats counter statistics plugin"}],"references":[{"url":"http://seclists.org/fulldisclosure/2017/Feb/74","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://vuldb.com/?id.97367","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-20099"},{"url":"https://github.com/advisories/GHSA-36vr-cpp3-vrwf"}],"sources":{"cve":[{"id":"CVE-2017-20099","title":"Analytics Stats Counter Statistics Plugin code injection","description":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.","status":"published","published":"2022-06-27T18:11:03Z","modified":"2025-04-15T14:12:10.791Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:33:11.59359Z"}],"euvd":[{"id":"EUVD-2017-11106","description":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.","status":"published","published":"2022-06-27T18:11:03Z","modified":"2025-04-15T14:12:10Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:52:29.674488Z"}],"ghsa":[{"id":"GHSA-36vr-cpp3-vrwf","title":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as...","description":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.","status":"published","published":"2022-06-28T00:00:44Z","modified":"2023-01-27T05:05:22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:42:40.834674Z"}],"nvd":[{"id":"CVE-2017-20099","description":"A vulnerability was found in Analytics Stats Counter Statistics Plugin 1.2.2.5 and classified as critical. This issue affects some unknown processing. The manipulation leads to code injection. The attack may be initiated remotely.","status":"published","published":"2022-06-27T19:15:08.003Z","modified":"2026-06-17T01:15:10.397Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:04:21.492973Z"}]}}