Phplist

CVE-2026-73482 Aug 13, 18:49 HIGH POC PATCH This Week

Administrator account deletion in phpList before 3.7.0-RC5 is exploitable via CSRF, allowing a remote attacker to permanently remove any non-self administrator account by tricking a logged-in super-administrator into loading a single crafted GET URL. The root cause is that the deletion endpoint in admins.php bypasses CSRF token validation when the token parameter is absent and the central verifyCsrfGetToken check is called with enforce=false, making the action trivially triggerable via an embedded image in an HTML email. A publicly available exploit is confirmed by VulnCheck; the vendor-released fix is v3.7.0-RC5, and no CISA KEV listing has been identified at time of analysis.

CVE-2026-73481 Aug 13, 18:48 MEDIUM POC PATCH This Month

Cross-site request forgery in phpList before 3.7.0-RC5 allows a remote, unauthenticated attacker to delete arbitrary bounce rules from a target phpList installation by tricking an authenticated administrator into loading a crafted URL. The deletion endpoint (bouncerules.php) accepts state-changing operations over GET and passes enforce=false to verifyCsrfGetToken, meaning the CSRF token check is only performed when the tk parameter is voluntarily present - effectively disabling the protection entirely. A publicly available exploit exists (GitHub issue #1116); the vendor has released a fix in v3.7.0-RC5, and no KEV listing or confirmed in-the-wild exploitation has been recorded at time of analysis.

CVE-2025-28074 May 08, 21:15 MEDIUM This Month

phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2025-28073 May 08, 20:15 MEDIUM This Month

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2023-27576 Aug 18, 15:15 MEDIUM POC This Month

An issue was discovered in phpList before 3.6.14. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-3188 Jan 26, 18:16 CRITICAL POC Act Now

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-35708 Dec 25, 06:15 HIGH POC This Week

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-15073 Jul 08, 20:15 MEDIUM POC This Month

An issue was discovered in phpList through 3.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-15072 Jul 08, 20:15 HIGH POC This Week

An issue was discovered in phpList through 3.5.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-13827 Jun 04, 15:15 MEDIUM POC This Month

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2020-12639 May 04, 14:15 MEDIUM This Month

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2020-8547 Feb 03, 16:15 CRITICAL POC Act Now

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2014-2916 May 05, 16:07 MEDIUM POC PATCH This Month

Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-5228 Oct 01, 20:55 MEDIUM POC This Month

Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

CVE-2012-2741 Sep 06, 17:55 MEDIUM POC PATCH THREAT This Month

Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 12.5%.

CVE-2012-2740 Sep 06, 17:55 HIGH POC PATCH This Week

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2012-4247 Aug 12, 00:55 MEDIUM POC PATCH This Month

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-4246 Aug 12, 00:55 MEDIUM POC This Month

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

CVE-2012-3953 Aug 12, 00:55 HIGH POC PATCH This Week

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2012-3952 Aug 12, 00:55 LOW POC Monitor

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.