Mailman CVE-2025-43920

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers t

/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. Rated medium severity (CVSS 6.5), this

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitr

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ dir

GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/cr

Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remot

Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote at

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that tok

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. Rated high severity (CVSS 8.0), this vulnerability is r

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the li

An issue was discovered in GNU Mailman before 2.1.28. Rated medium severity (CVSS 6.5), this vulnerability is remotely e

In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for