Priority HIGH 65
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler.
CVSS 4.0HIGH 7.2· Network · No auth · User interaction · EPSS 0.00262 · Published 2026-09-16 · Fixed in 3.6.17 CWE-352
Priority LOW 32
phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php.
CVSS 4.0HIGH 7.2· Network · No auth · User interaction · EPSS 0.0034 · Published 2026-08-13 · Fixed in 3.7.0-RC5 CWE-352
Priority MEDIUM 57
phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php).
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00222 · Published 2026-08-13 · Fixed in 3.7.0-RC5 CWE-352
Priority LOW 28
phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0065 · Published 2025-05-08 · No fix listed CWE-79
Priority LOW 30
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0065 · Published 2025-05-08 · No fix listed CWE-79
Priority LOW 32
An issue was discovered in phpList before 3.6.14.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00343 · Published 2023-08-18 · No fix listed CWE-639
Priority MEDIUM 58
A vulnerability, which was classified as problematic, was found in PHPList 3.2.6.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00608 · Published 2022-06-10 · No fix listed CWE-80
Priority MEDIUM 58
A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00608 · Published 2022-06-10 · No fix listed CWE-80
Priority MEDIUM 58
A vulnerability classified as problematic was found in PHPList 3.2.6.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00608 · Published 2022-06-10 · No fix listed CWE-80
Priority MEDIUM 60
A vulnerability classified as problematic has been found in PHPList 3.2.6.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00759 · Published 2022-06-10 · No fix listed CWE-80
Priority HIGH 75
A vulnerability was found in PHPList 3.2.6.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00979 · Published 2022-06-10 · No fix listed CWE-89
Priority MEDIUM 47
A vulnerability was found in PHPList 3.2.6.
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00922 · Published 2022-06-10 · No fix listed CWE-200
Priority HIGH 65
A vulnerability was found in PHPList 3.2.6.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00882 · Published 2022-06-10 · No fix listed CWE-89
Priority HIGH 81
A vulnerability was found in PHPList 3.2.6 and classified as critical.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.21001 · Published 2022-06-10 · No fix listed CWE-89
Priority MEDIUM 47
Remote Code Execution vulnerability in phplist 3.5.1.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0289 · Published 2021-07-06 · No fix listed CWE-434
Priority LOW 23
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00622 · Published 2021-07-06 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00509 · Published 2021-07-02 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign" field under the "Send a campaign" module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00522 · Published 2021-07-02 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00512 · Published 2021-07-02 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage admini…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00528 · Published 2021-07-02 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00512 · Published 2021-07-02 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00558 · Published 2021-07-01 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00551 · Published 2021-07-01 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00516 · Published 2021-07-01 · No fix listed CWE-79
Priority LOW 25
A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign"…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00551 · Published 2021-07-01 · No fix listed CWE-79
Load more
THREATIST.IORead the docs