phplist

Records44All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

phplist records in CISA KEV

No phplist vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Phplist 40 records HIGH Mailing List Manager 1 record LOW

Records

40 records in Phplist · all components

TI-2017-14100 CVE-2017-20029 · GHSA-qgmx-gfj6-93pm

PHPList Edit Subscription index.php sql injection

HIGH 81

A vulnerability was found in PHPList 3.2.6 and classified as critical.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.21001 Published 2022-06-10 No fix listed CWE-89

TI-2017-14103 CVE-2017-20032 · GHSA-77g7-56pw-hwjp

PHPList Subscription sql injection

HIGH 75

A vulnerability was found in PHPList 3.2.6.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00979 Published 2022-06-10 No fix listed CWE-89

TI-2017-14101 CVE-2017-20030 · GHSA-gxmq-45pc-rjq6

PHPList Sending Campain sql injection

HIGH 65

A vulnerability was found in PHPList 3.2.6.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00882 Published 2022-06-10 No fix listed CWE-89

TI-2017-14104 CVE-2017-20033 · GHSA-jff2-f2xp-77cm

PHPList Reflected cross site scriting

MEDIUM 60

A vulnerability classified as problematic has been found in PHPList 3.2.6.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00759 Published 2022-06-10 No fix listed CWE-80

TI-2017-14107 CVE-2017-20036 · GHSA-p2vm-vrmh-7xf6

PHPList Bounce Rule Persistent cross site scriting

MEDIUM 58

A vulnerability, which was classified as problematic, was found in PHPList 3.2.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2022-06-10 No fix listed CWE-80

TI-2017-14106 CVE-2017-20035 · GHSA-w8mj-62rj-8cjc

PHPList Subscribe Persistent cross site scriting

MEDIUM 58

A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2022-06-10 No fix listed CWE-80

TI-2017-14105 CVE-2017-20034 · GHSA-659x-gwx9-46gq

PHPList List Name Persistent cross site scriting

MEDIUM 58

A vulnerability classified as problematic was found in PHPList 3.2.6.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00608 Published 2022-06-10 No fix listed CWE-80

TI-2020-06848 CVE-2020-8547 · GHSA-jpch-xv32-p766

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of…

MEDIUM 51

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05861 Published 2020-02-03 No fix listed

TI-2020-14313 CVE-2020-22249 · GHSA-5rjh-phx5-w966

Remote Code Execution vulnerability in phplist 3.5.1.

MEDIUM 47

Remote Code Execution vulnerability in phplist 3.5.1.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0289 Published 2021-07-06 No fix listed CWE-434

TI-2017-14102 CVE-2017-20031 · GHSA-pvfq-5j8q-r5f5

PHPList information disclosure

MEDIUM 47

A vulnerability was found in PHPList 3.2.6.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00922 Published 2022-06-10 No fix listed CWE-200

TI-2021-02264 CVE-2021-3188 · GHSA-m95q-pxcq-5m5r

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

MEDIUM 46

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0181 Published 2021-01-21 No fix listed CWE-1236

TI-2020-14546 CVE-2020-23361 · GHSA-5gqq-53xx-954h

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for…

MEDIUM 45

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01223 Published 2021-01-27 No fix listed

TI-2008-05871 CVE-2008-6178 · GHSA-rpgr-6wmp-w7j7

Unrestricted file upload vulnerability in…

MEDIUM 43

Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07811 Published 2009-02-19 No fix listed CWE-94

TI-2020-11850 CVE-2020-15072 · GHSA-x5mc-6q9h-2g4j

An issue was discovered in phpList through 3.5.4.

MEDIUM 40

An issue was discovered in phpList through 3.5.4.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01199 Published 2020-07-08 No fix listed CWE-89

TI-2012-02371 CVE-2012-2740 · GHSA-qj74-3hv7-w292

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows…

LOW 39

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03329 Published 2012-09-06 No fix listed CWE-89

TI-2020-18168 CVE-2020-35708 · GHSA-v439-79v8-38g8

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file…

LOW 35

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01499 Published 2020-12-25 No fix listed CWE-89

TI-2012-03374 CVE-2012-3953 · GHSA-f8f7-wvqm-7wj3

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote…

LOW 35

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01122 Published 2012-08-12 No fix listed CWE-89

TI-2006-05335 CVE-2006-5524 · GHSA-4rv5-cvr5-mg5p

Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote…

LOW 34

Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0209 Published 2006-10-26 No fix listed

TI-2023-12286 CVE-2023-27576 · GHSA-hpr7-fpw7-jcx2

An issue was discovered in phpList before 3.6.14.

LOW 32

An issue was discovered in phpList before 3.6.14.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00343 Published 2023-08-18 No fix listed CWE-639

TI-2014-02343 CVE-2014-2916 · GHSA-w9jc-8977-qq28

Cross-site request forgery (CSRF) vulnerability in the subscription page editor…

LOW 32

Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01079 Published 2014-05-05 No fix listed CWE-352

TI-2025-20703 CVE-2025-28073 · GHSA-4pgh-326f-32p3

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the…

LOW 30

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00638 Published 2025-05-08 No fix listed CWE-79

TI-2020-10813 CVE-2020-13827 · GHSA-f969-r685-p3gx

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.

LOW 29

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0087 Published 2020-06-04 No fix listed CWE-79

TI-2025-20704 CVE-2025-28074 · GHSA-9vv2-f3c8-m9x6

phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input…

LOW 28

phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00638 Published 2025-05-08 No fix listed CWE-79

TI-2020-10049 CVE-2020-12639 · GHSA-43p3-w85x-8jw6

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.

LOW 28

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00699 Published 2020-05-04 No fix listed CWE-79

TI-2020-11851 CVE-2020-15073 · GHSA-rvh8-jqf6-87pm

An issue was discovered in phpList through 3.5.4.

LOW 26

An issue was discovered in phpList through 3.5.4.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00749 Published 2020-07-08 No fix listed CWE-79

Open these records in search →