{"id":"CVE-2025-28073","aliases":["EUVD-2025-14043","GHSA-4pgh-326f-32p3"],"status":"published","title":"phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php...","description":"phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.0065,"percentile":0.51435,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2025-05-08T00:00:00Z","modified":"2026-10-28T02:30:41Z","exploits":[{"source":"pocgithub","id":"mLniumm/CVE-2025-28073","title":"mLniumm/CVE-2025-28073","date":"2025-05-07","url":"https://github.com/mLniumm/CVE-2025-28073"}],"products":[{"vendor":"phplist","product":"phplist"}],"references":[{"url":"https://github.com/phpList/phplist3","tags":["Product","package"]},{"url":"https://github.com/mLniumm/CVE-2025-28073","tags":["Third Party Advisory","package"]},{"url":"https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15","tags":["Product","web"]},{"url":"https://www.phplist.org/newslist/phplist-3-6-15-release-notes/","tags":["Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-28073","tags":["advisory"]},{"url":"https://www.phplist.org/newslist/phplist-3-6-15-release-notes"},{"url":"https://github.com/advisories/GHSA-4pgh-326f-32p3"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/28xxx/CVE-2025-28073.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-28073","description":"phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.","status":"published","published":"2025-05-08T00:00:00Z","modified":"2025-06-07T18:47:04.353Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:50.176138Z"}],"euvd":[{"id":"EUVD-2025-14043","description":"phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.","status":"published","published":"2025-05-08T00:00:00Z","modified":"2025-06-07T18:47:04Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:28.158705Z"}],"ghsa":[{"id":"GHSA-4pgh-326f-32p3","title":"phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php...","description":"phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.","status":"published","published":"2025-05-08T21:32:56Z","modified":"2025-06-07T21:31:33Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:02:37.263061Z"}],"nvd":[{"id":"CVE-2025-28073","description":"phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.","status":"published","published":"2025-05-08T20:15:29.537Z","modified":"2026-06-17T09:04:32.113Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:06.085152Z"}],"osv":[{"id":"CVE-2025-28073","description":"phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.","status":"published","published":"2025-05-08T00:00:00Z","modified":"2026-10-28T02:30:41.91355005Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:47.708311Z"}]}}