Skip to main content

Phplist CVE-2021-3188

CRITICAL
Improper Neutralization of Formula Elements in a CSV File (CWE-1236)
2021-01-26 cve@mitre.org
Code Injection Phplist
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Jan 26, 2021 - 18:16 nvd
CRITICAL 9.8

DescriptionNVD

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

AnalysisAI

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1236. phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. Affected products include: Phplist.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Phplist

View all
CVE-2020-8547 CRITICAL POC
9.8 Feb 03

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which m
CVE-2020-15072 HIGH POC
8.8 Jul 08

An issue was discovered in phpList through 3.5.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
CVE-2012-2740 HIGH POC
7.5 Sep 06

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbi
CVE-2012-3953 HIGH POC
7.5 Aug 12

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitra
CVE-2020-35708 HIGH POC
7.2 Dec 25

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Adminis
CVE-2014-2916 MEDIUM POC
6.8 May 05

Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allo
CVE-2012-2741 MEDIUM POC
4.3 Sep 06

Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers t
CVE-2023-27576 MEDIUM POC
6.7 Aug 18

An issue was discovered in phpList before 3.6.14. Rated medium severity (CVSS 6.7), this vulnerability is low attack com
CVE-2020-13827 MEDIUM POC
6.1 Jun 04

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. Rated medium severity (CVSS 6.1),

CVE-2012-5228 MEDIUM POC
4.3 Oct 01

Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions befo
CVE-2012-4246 MEDIUM POC
4.3 Aug 12

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote atta
CVE-2020-15073 MEDIUM POC
5.4 Jul 08

An issue was discovered in phpList through 3.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely explo

Same weakness CWE-1236 – Improper Neutralization of Formula Elements in a CSV File

View all
CVE-2019-14749 HIGH POC
8.8
CVE-2020-36962 CRITICAL POC
9.8
CVE-2023-46401 CRITICAL POC
9.8
CVE-2025-56267 CRITICAL POC
9.8
CVE-2021-47901 CRITICAL POC
9.8
CVE-2020-36941 CRITICAL POC
9.8
CVE-2022-3574 CRITICAL POC
9.8
CVE-2022-3463 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2012-0158 HIGH POC
8.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-3906 HIGH POC
7.8
CVE-2017-9822 HIGH POC
8.8
CVE-2018-1273 CRITICAL POC
9.8

Share

CVE-2021-3188 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy