phplist

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

phplist records in CISA KEV

No phplist vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Phplist 40 records HIGH Mailing List Manager 1 record LOW

Records

44 records

TI-2017-14100 CVE-2017-20029 · GHSA-qgmx-gfj6-93pm

PHPList Edit Subscription index.php sql injection

HIGH 81

A vulnerability was found in PHPList 3.2.6 and classified as critical.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21001 Published 2022-06-10 No fix listed CWE-89

TI-2017-14103 CVE-2017-20032 · GHSA-77g7-56pw-hwjp

PHPList Subscription sql injection

HIGH 75

A vulnerability was found in PHPList 3.2.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00979 Published 2022-06-10 No fix listed CWE-89

TI-2026-62545 CVE-2026-92806 · GHSA-q6pp-9mv4-x9xp

phpList before 3.6.17 Cross-Site Request Forgery via massremove.php

HIGH 65

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler.

CVSS 4.0HIGH 7.2 Network No auth User interaction EPSS 0.00262 Published 2026-09-16 Fixed in 3.6.17 CWE-352

TI-2017-14101 CVE-2017-20030 · GHSA-gxmq-45pc-rjq6

PHPList Sending Campain sql injection

HIGH 65

A vulnerability was found in PHPList 3.2.6.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00882 Published 2022-06-10 No fix listed CWE-89

TI-2017-14104 CVE-2017-20033 · GHSA-jff2-f2xp-77cm

PHPList Reflected cross site scriting

MEDIUM 60

A vulnerability classified as problematic has been found in PHPList 3.2.6.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00759 Published 2022-06-10 No fix listed CWE-80

TI-2017-14107 CVE-2017-20036 · GHSA-p2vm-vrmh-7xf6

PHPList Bounce Rule Persistent cross site scriting

MEDIUM 58

A vulnerability, which was classified as problematic, was found in PHPList 3.2.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2022-06-10 No fix listed CWE-80

TI-2017-14106 CVE-2017-20035 · GHSA-w8mj-62rj-8cjc

PHPList Subscribe Persistent cross site scriting

MEDIUM 58

A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2022-06-10 No fix listed CWE-80

TI-2017-14105 CVE-2017-20034 · GHSA-659x-gwx9-46gq

PHPList List Name Persistent cross site scriting

MEDIUM 58

A vulnerability classified as problematic was found in PHPList 3.2.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2022-06-10 No fix listed CWE-80

TI-2026-51593 CVE-2026-73481 · GHSA-328j-qh6x-vvjq

phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules

MEDIUM 57

phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php).

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00222 Published 2026-08-13 Fixed in 3.7.0-RC5 CWE-352

TI-2020-06848 CVE-2020-8547 · GHSA-jpch-xv32-p766

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of…

MEDIUM 51

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05861 Published 2020-02-03 No fix listed

TI-2020-14313 CVE-2020-22249 · GHSA-5rjh-phx5-w966

Remote Code Execution vulnerability in phplist 3.5.1.

MEDIUM 47

Remote Code Execution vulnerability in phplist 3.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0289 Published 2021-07-06 No fix listed CWE-434

TI-2017-14102 CVE-2017-20031 · GHSA-pvfq-5j8q-r5f5

PHPList information disclosure

MEDIUM 47

A vulnerability was found in PHPList 3.2.6.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00922 Published 2022-06-10 No fix listed CWE-200

TI-2021-02264 CVE-2021-3188 · GHSA-m95q-pxcq-5m5r

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

MEDIUM 46

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0181 Published 2021-01-21 No fix listed CWE-1236

TI-2020-14546 CVE-2020-23361 · GHSA-5gqq-53xx-954h

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for…

MEDIUM 45

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01223 Published 2021-01-27 No fix listed

TI-2008-05871 CVE-2008-6178 · GHSA-rpgr-6wmp-w7j7

Unrestricted file upload vulnerability in…

MEDIUM 43

Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07811 Published 2009-02-19 No fix listed CWE-94

TI-2020-11850 CVE-2020-15072 · GHSA-x5mc-6q9h-2g4j

An issue was discovered in phpList through 3.5.4.

MEDIUM 40

An issue was discovered in phpList through 3.5.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01199 Published 2020-07-08 No fix listed CWE-89

TI-2012-02371 CVE-2012-2740 · GHSA-qj74-3hv7-w292

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows…

LOW 39

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03329 Published 2012-09-06 No fix listed CWE-89

TI-2020-18168 CVE-2020-35708 · GHSA-v439-79v8-38g8

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file…

LOW 35

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01499 Published 2020-12-25 No fix listed CWE-89

TI-2012-03374 CVE-2012-3953 · GHSA-f8f7-wvqm-7wj3

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote…

LOW 35

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01122 Published 2012-08-12 No fix listed CWE-89

TI-2006-05335 CVE-2006-5524 · GHSA-4rv5-cvr5-mg5p

Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote…

LOW 34

Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0209 Published 2006-10-26 No fix listed

TI-2026-51594 CVE-2026-73482 · GHSA-g3p8-wf9w-rf82

phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php

LOW 32

phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php.

CVSS 4.0HIGH 7.2 Network No auth User interaction EPSS 0.0034 Published 2026-08-13 Fixed in 3.7.0-RC5 CWE-352

TI-2023-12286 CVE-2023-27576 · GHSA-hpr7-fpw7-jcx2

An issue was discovered in phpList before 3.6.14.

LOW 32

An issue was discovered in phpList before 3.6.14.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00343 Published 2023-08-18 No fix listed CWE-639

TI-2014-02343 CVE-2014-2916 · GHSA-w9jc-8977-qq28

Cross-site request forgery (CSRF) vulnerability in the subscription page editor…

LOW 32

Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01079 Published 2014-05-05 No fix listed CWE-352

TI-2025-20703 CVE-2025-28073 · GHSA-4pgh-326f-32p3

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the…

LOW 30

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00638 Published 2025-05-08 No fix listed CWE-79

TI-2020-10813 CVE-2020-13827 · GHSA-f969-r685-p3gx

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.

LOW 29

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0087 Published 2020-06-04 No fix listed CWE-79

Open these records in search →