Read the docs
TI-2012-03373 Aliases CVE-2012-3952GHSA-996x-56fr-67x6

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19…

Priority LOW 17CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

Why it matters now

EPSS 0.01927 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:phplist:phplist:*:*:*:*:*:*:*:*up to 2.10.18Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.6.5:*:*:*:*:*:*:*2.6.5Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.7.1:*:*:*:*:*:*:*2.7.1Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.7.2:*:*:*:*:*:*:*2.7.2Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.8.2:*:*:*:*:*:*:*2.8.2Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.8.7:*:*:*:*:*:*:*2.8.7Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.8.12:*:*:*:*:*:*:*2.8.12Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.1:*:*:*:*:*:*:*2.10.1Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.2:*:*:*:*:*:*:*2.10.2Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.3:*:*:*:*:*:*:*2.10.3Vulnerablephplist
  • cpe:2.3:a:phplist:phplist:*:*:*:*:*:*:*:* Versions up to 2.10.18 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.6.5:*:*:*:*:*:*:* Versions 2.6.5 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.7.2:*:*:*:*:*:*:* Versions 2.7.2 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.8.2:*:*:*:*:*:*:* Versions 2.8.2 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.8.7:*:*:*:*:*:*:* Versions 2.8.7 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.8.12:*:*:*:*:*:*:* Versions 2.8.12 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.2:*:*:*:*:*:*:* Versions 2.10.2 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.3:*:*:*:*:*:*:* Versions 2.10.3 Vulnerable ·phplist
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:phplist:phplist:2.10.4:*:*:*:*:*:*:*2.10.4Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.5:*:*:*:*:*:*:*2.10.5Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.7:*:*:*:*:*:*:*2.10.7Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.8:*:*:*:*:*:*:*2.10.8Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.9:*:*:*:*:*:*:*2.10.9Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.10:*:*:*:*:*:*:*2.10.10Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.11:*:*:*:*:*:*:*2.10.11Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.12:*:*:*:*:*:*:*2.10.12Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.13:*:*:*:*:*:*:*2.10.13Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.14:*:*:*:*:*:*:*2.10.14Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.15:*:*:*:*:*:*:*2.10.15Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.16:*:*:*:*:*:*:*2.10.16Vulnerablephplist
cpe:2.3:a:phplist:phplist:2.10.17:*:*:*:*:*:*:*2.10.17Vulnerablephplist
  • cpe:2.3:a:phplist:phplist:2.10.4:*:*:*:*:*:*:* Versions 2.10.4 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.5:*:*:*:*:*:*:* Versions 2.10.5 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.7:*:*:*:*:*:*:* Versions 2.10.7 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.8:*:*:*:*:*:*:* Versions 2.10.8 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.9:*:*:*:*:*:*:* Versions 2.10.9 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.10:*:*:*:*:*:*:* Versions 2.10.10 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.11:*:*:*:*:*:*:* Versions 2.10.11 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.12:*:*:*:*:*:*:* Versions 2.10.12 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.13:*:*:*:*:*:*:* Versions 2.10.13 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.14:*:*:*:*:*:*:* Versions 2.10.14 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.15:*:*:*:*:*:*:* Versions 2.10.15 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.16:*:*:*:*:*:*:* Versions 2.10.16 Vulnerable ·phplist
  • cpe:2.3:a:phplist:phplist:2.10.17:*:*:*:*:*:*:* Versions 2.10.17 Vulnerable ·phplist

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2012-3952
  2. 2026-10-03 Alias added: GHSA-996x-56fr-67x6

References

Exploit 1

Other 3

  • TI-2017-14100 PHPList Edit Subscription index.php sql injection CVSS 3.1CRITICAL 9.8
  • TI-2017-14103 PHPList Subscription sql injection CVSS 3.1CRITICAL 9.8
  • TI-2017-14101 PHPList Sending Campain sql injection CVSS 3.1HIGH 7.2
  • TI-2017-14104 PHPList Reflected cross site scriting CVSS 3.1MEDIUM 6.1
  • TI-2017-14107 PHPList Bounce Rule Persistent cross site scriting CVSS 3.1MEDIUM 5.4
  • TI-2017-14106 PHPList Subscribe Persistent cross site scriting CVSS 3.1MEDIUM 5.4
See all 39 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences