Vendor CVEs
Phplist
All CVEs
56 total · sorted by risk| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-8547 | Cri | 0.67 | 9.8 | 0.06 | Feb 3, 2020 | phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. | ||
| CVE-2020-22249 | Cri | 0.64 | 9.8 | 0.03 | Jul 6, 2021 | Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which… | ||
| CVE-2020-23361 | Cri | 0.64 | 9.8 | 0.01 | Jan 27, 2021 | phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. | ||
| CVE-2021-3188 | Cri | 0.64 | 9.8 | 0.02 | Jan 26, 2021 | phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. | ||
| CVE-2020-15072 | Hig | 0.57 | 8.8 | 0.01 | Jul 8, 2020 | An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section. | ||
| CVE-2017-20029 | Hig | 0.49 | 7.3 | 0.20 | Jun 10, 2022 | A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been… | ||
| CVE-2020-35708 | Hig | 0.47 | 7.2 | 0.01 | Dec 25, 2020 | phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page. | ||
| CVE-2026-73482 | Hig | 0.46 | 8.1 | 0.00 | Aug 13, 2026 | phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central… | ||
| CVE-2017-20032 | Med | 0.41 | 6.3 | 0.01 | Jun 10, 2022 | A vulnerability was found in PHPList 3.2.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subscription. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the… | ||
| CVE-2025-28074 | Med | 0.40 | 6.1 | 0.01 | May 8, 2025 | phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to… | ||
| CVE-2025-28073 | Med | 0.40 | 6.1 | 0.01 | May 8, 2025 | phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. | ||
| CVE-2020-13827 | Med | 0.40 | 6.1 | 0.01 | Jun 4, 2020 | phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. | ||
| CVE-2020-12639 | Med | 0.40 | 6.1 | 0.01 | May 4, 2020 | phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. | ||
| CVE-2020-36399 | Med | 0.35 | 5.4 | 0.01 | Jul 2, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module. | ||
| CVE-2020-36398 | Med | 0.35 | 5.4 | 0.01 | Jul 2, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign" field under the "Send a campaign" module. | ||
| CVE-2020-23194 | Med | 0.35 | 5.4 | 0.01 | Jul 2, 2021 | A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||
| CVE-2020-23192 | Med | 0.35 | 5.4 | 0.01 | Jul 2, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module. | ||
| CVE-2020-23190 | Med | 0.35 | 5.4 | 0.01 | Jul 2, 2021 | A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||
| CVE-2020-23217 | Med | 0.35 | 5.4 | 0.01 | Jul 1, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module. | ||
| CVE-2020-23214 | Med | 0.35 | 5.4 | 0.01 | Jul 1, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists" module. | ||
| CVE-2020-23209 | Med | 0.35 | 5.4 | 0.01 | Jul 1, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module. | ||
| CVE-2020-23208 | Med | 0.35 | 5.4 | 0.01 | Jul 1, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module. | ||
| CVE-2020-23207 | Med | 0.35 | 5.4 | 0.01 | Jul 1, 2021 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Edit Values" field under the "Configure Attributes" module. | ||
| CVE-2020-15073 | Med | 0.35 | 5.4 | 0.01 | Jul 8, 2020 | An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section. | ||
| CVE-2017-20030 | Med | 0.31 | 4.7 | 0.01 | Jun 10, 2022 | A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Sending Campain. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been… | ||
| CVE-2020-22251 | Med | 0.31 | 4.8 | 0.01 | Jul 6, 2021 | Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin. | ||
| CVE-2026-73481 | Med | 0.28 | 5.4 | 0.00 | Aug 13, 2026 | phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with… | ||
| CVE-2017-20033 | Med | 0.28 | 4.3 | 0.01 | Jun 10, 2022 | A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send\'\";> leads to cross site scripting (Reflected). It is possible… | ||
| CVE-2017-20036 | Low | 0.23 | 3.5 | 0.01 | Jun 10, 2022 | A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bounce Rule. The manipulation leads to cross site scripting (Persistent). It is possible to launch the attack remotely.… | ||
| CVE-2017-20035 | Low | 0.23 | 3.5 | 0.01 | Jun 10, 2022 | A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation leads to cross site scripting (Persistent). The attack may be initiated… | ||
| CVE-2017-20034 | Low | 0.23 | 3.5 | 0.01 | Jun 10, 2022 | A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting (Persistent). The attack can be initiated remotely. Upgrading to… | ||
| CVE-2017-20031 | Low | 0.18 | 2.7 | 0.01 | Jun 10, 2022 | A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument sortby with the input password leads to information disclosure. The attack can be launched remotely. The… | ||
| CVE-2008-6178 | 0.04 | — | 0.08 | Feb 19, 2009 | Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a… | |||
| CVE-2006-1749 | 0.04 | — | 0.08 | Apr 12, 2006 | PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. NOTE: this issue was later reported to affect 2.01 as well. | |||
| CVE-2012-5228 | 0.03 | — | 0.02 | Oct 1, 2012 | Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third… | |||
| CVE-2012-2741 | 0.03 | — | 0.03 | Sep 6, 2012 | Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action. | |||
| CVE-2012-2740 | 0.03 | — | 0.03 | Sep 6, 2012 | SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action. | |||
| CVE-2012-4247 | 0.03 | — | 0.02 | Aug 12, 2012 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix… | |||
| CVE-2012-4246 | 0.03 | — | 0.02 | Aug 12, 2012 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page. | |||
| CVE-2012-3953 | 0.03 | — | 0.01 | Aug 12, 2012 | SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page. | |||
| CVE-2012-3952 | 0.03 | — | 0.02 | Aug 12, 2012 | Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page. | |||
| CVE-2011-1682 | 0.03 | — | 0.01 | Apr 13, 2011 | Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create a list or (2) insert cross-site scripting (XSS) sequences. NOTE: this issue exists… | |||
| CVE-2011-0748 | 0.03 | — | 0.01 | Apr 13, 2011 | Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) edit administrator accounts. | |||
| CVE-2009-0422 | 0.03 | — | 0.06 | Feb 5, 2009 | Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SERVER[ConfigFile] parameter to… | |||
| CVE-2006-5524 | 0.03 | — | 0.02 | Oct 26, 2006 | Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: This issue might overlap CVE-2006-5321. | |||
| CVE-2006-5294 | 0.03 | — | 0.02 | Oct 16, 2006 | Cross-site scripting (XSS) vulnerability in index.php in phplist before 2.10.3 allows remote attackers to inject arbitrary web script or HTML via the unsubscribeemail parameter. | |||
| CVE-2006-2523 | 0.03 | — | 0.03 | May 22, 2006 | PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie. | |||
| CVE-2005-3556 | 0.03 | — | 0.04 | Nov 16, 2005 | Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php, (2) title parameter in (b) admin/spageedit.php, (3) title field in (c)… | |||
| CVE-2008-5887 | 0.01 | — | 0.09 | Jan 12, 2009 | phplist before 2.10.8 allows remote attackers to include files via unknown vectors, related to a "local file include vulnerability." | |||
| CVE-2023-27576 | Med | 0.00 | 6.7 | 0.00 | Aug 18, 2023 | An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with… |
- risk 0.67cvss 9.8epss 0.06
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
- risk 0.64cvss 9.8epss 0.03
Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains the php files with extensions like PHP,phtml,php7 will be copied to the plugins directory which…
- risk 0.64cvss 9.8epss 0.01
phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
- risk 0.64cvss 9.8epss 0.02
phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.
- risk 0.57cvss 8.8epss 0.01
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
- risk 0.49cvss 7.3epss 0.20
A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been…
- risk 0.47cvss 7.2epss 0.01
phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.
- risk 0.46cvss 8.1epss 0.00
phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the central…
- risk 0.41cvss 6.3epss 0.01
A vulnerability was found in PHPList 3.2.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subscription. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the…
- risk 0.40cvss 6.1epss 0.01
phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to…
- risk 0.40cvss 6.1epss 0.01
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.
- risk 0.40cvss 6.1epss 0.01
phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.
- risk 0.40cvss 6.1epss 0.01
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign" field under the "Send a campaign" module.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists" module.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module.
- risk 0.35cvss 5.4epss 0.01
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Edit Values" field under the "Configure Attributes" module.
- risk 0.35cvss 5.4epss 0.01
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
- risk 0.31cvss 4.7epss 0.01
A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Sending Campain. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been…
- risk 0.31cvss 4.8epss 0.01
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
- risk 0.28cvss 5.4epss 0.00
phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is performed via a GET request (?page=bouncerules&del=N), and the central CSRF check (verifyCsrfGetToken) is invoked with…
- risk 0.28cvss 4.3epss 0.01
A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send\'\";> leads to cross site scripting (Reflected). It is possible…
- risk 0.23cvss 3.5epss 0.01
A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bounce Rule. The manipulation leads to cross site scripting (Persistent). It is possible to launch the attack remotely.…
- risk 0.23cvss 3.5epss 0.01
A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of the component Subscribe. The manipulation leads to cross site scripting (Persistent). The attack may be initiated…
- risk 0.23cvss 3.5epss 0.01
A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting (Persistent). The attack can be initiated remotely. Upgrading to…
- risk 0.18cvss 2.7epss 0.01
A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument sortby with the input password leads to information disclosure. The attack can be launched remotely. The…
- CVE-2008-6178Feb 19, 2009risk 0.04cvss —epss 0.08
Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a…
- CVE-2006-1749Apr 12, 2006risk 0.04cvss —epss 0.08
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0 and earlier allows remote attackers to execute arbitrary PHP code via the returnpath parameter. NOTE: this issue was later reported to affect 2.01 as well.
- CVE-2012-5228Oct 1, 2012risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third…
- CVE-2012-2741Sep 6, 2012risk 0.03cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.
- CVE-2012-2740Sep 6, 2012risk 0.03cvss —epss 0.03
SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.
- CVE-2012-4247Aug 12, 2012risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix…
- CVE-2012-4246Aug 12, 2012risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.
- CVE-2012-3953Aug 12, 2012risk 0.03cvss —epss 0.01
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.
- CVE-2012-3952Aug 12, 2012risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
- CVE-2011-1682Apr 13, 2011risk 0.03cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create a list or (2) insert cross-site scripting (XSS) sequences. NOTE: this issue exists…
- CVE-2011-0748Apr 13, 2011risk 0.03cvss —epss 0.01
Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) edit administrator accounts.
- CVE-2009-0422Feb 5, 2009risk 0.03cvss —epss 0.06
Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the _SERVER[ConfigFile] parameter to…
- CVE-2006-5524Oct 26, 2006risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: This issue might overlap CVE-2006-5321.
- CVE-2006-5294Oct 16, 2006risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in index.php in phplist before 2.10.3 allows remote attackers to inject arbitrary web script or HTML via the unsubscribeemail parameter.
- CVE-2006-2523May 22, 2006risk 0.03cvss —epss 0.03
PHP remote file inclusion vulnerability in config.php in phpListPro 2.0.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute arbitrary PHP code via a URL in the Language cookie.
- CVE-2005-3556Nov 16, 2005risk 0.03cvss —epss 0.04
Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php, (2) title parameter in (b) admin/spageedit.php, (3) title field in (c)…
- CVE-2008-5887Jan 12, 2009risk 0.01cvss —epss 0.09
phplist before 2.10.8 allows remote attackers to include files via unknown vectors, related to a "local file include vulnerability."
- risk 0.00cvss 6.7epss 0.00
An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with…
Page 1 of 2