CVE-2005-4142
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination...
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.
Exploit likelihood
What each source reports
NVD Score used
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.
- Record
CVE-2005-4142- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.
- Record
CVE-2005-4142- Updated
- 2026-11-02
EUVDEUVD-2005-4137 No score
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.
- Record
EUVD-2005-4137- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8prw-qcgj-xjrj No score
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination...
The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.
- Record
GHSA-8prw-qcgj-xjrj- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-4142 is a high vulnerability (CVSS 7.5) in Lyris Technologies Inc Listmanager, published December 10, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.01%, the 87th percentile. No source names a fixed version.
References
osvdb.org/21547
securityfocus.com/archive/1/419077/100/0/threaded
metasploit.com/research/vulns/lyris_listmanager
vupen.com/english/advisories/2005/2820
archives.neohapsis.com/archives/fulldisclosure/2005-12/0349.html
secunia.com/advisories/17943
nvd.nist.gov/vuln/detail/CVE-2005-4142
github.com/advisories/GHSA-8prw-qcgj-xjrj