CVE-2001-0835: Cross-site scripting vulnerability in Webalizer 2.01-06, and possibly other versions, allows remote attacke...

Security readout for executives and security teams

Webalizer can place attacker-controlled text into its generated web traffic reports without safely neutralizing HTML. If someone views a poisoned report, their browser may execute attacker-supplied content in that report context. Exposure is likely limited to environments still running affected Webalizer versions or old distribution packages, especially where reports are viewed in a browser or published internally. Treat as targeted cleanup, not an emergency, unless legacy Webalizer reports are still exposed or viewed by privileged staff. The main business risk is browser-side compromise through trusted reporting pages. Mitigation focus: Identify any Webalizer deployments and installed package versions.; Review the linked vendor advisories for corrected packages or configuration guidance.; Restrict access to generated Webalizer reports, especially administrative reports..

Prepared

Jul 1, 2026, 08:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.