← All advisories

Medium severity6.5NVD Advisory· Published Jun 4, 2025· Updated Jun 17, 2026

CVE-2025-46011

CVE-2025-46011

Description

Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Knadh/Listmonk2 versions
cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:nadh:listmonk:*:*:*:*:*:*:*:*range: >=2.4.0,<5.0.0
- (no CPE)range: <5.0.0
Listmonk/Listmonkdescription

Patches

Vulnerability mechanics

References

5

github.com/knadh/listmonk/commit/4b805f885b9f5a20126ec06f8b59dc448c4af33bnvdPatch
github.com/kevinroleke/security/tree/main/CVE-2025-46011nvdThird Party Advisory
github.com/knadh/listmonk/issues/2412nvdIssue TrackingMitigation
github.com/knadh/listmonk/releases/tag/v4.1.0nvdRelease Notes
github.com/knadh/listmonk/releases/tag/v5.0.0nvdRelease Notes

News mentions

0

No linked articles in our index yet.