Phplist vulnerabilities

Products

• Phplist 41
• Phplist3 2

Newest

• phplist phpList before 3.6.17 Cross-Site Request Forgery via massremove.php CVE-2026-92806 7.2 HighSeptember 16, 2026
• phplist phplist3 phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php CVE-2026-73482 7.2 HighAugust 13, 2026
• phplist phplist3 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules CVE-2026-73481 5.3 MediumAugust 13, 2026
• phplist phpList prior to 3.6.3 is vulnerable to Cross-Site Scripting (XSS) due to improper input... CVE-2025-28074 Public exploit 6.1 MediumMay 8, 2025
• phplist phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php... CVE-2025-28073 Public exploit 6.1 MediumMay 8, 2025
• phplist An issue was discovered in phpList 3.6.12. Due to an access error, it was possible to manipulate... CVE-2023-27576 6.7 MediumAugust 18, 2023
• phplist PHPList Bounce Rule Persistent cross site scriting CVE-2017-20036 3.5 LowJune 10, 2022
• phplist PHPList Subscribe Persistent cross site scriting CVE-2017-20035 3.5 LowJune 10, 2022
• phplist PHPList List Name Persistent cross site scriting CVE-2017-20034 3.5 LowJune 10, 2022
• phplist PHPList Reflected cross site scriting CVE-2017-20033 4.3 MediumJune 10, 2022
• phplist PHPList Subscription sql injection CVE-2017-20032 6.3 MediumJune 10, 2022
• phplist PHPList information disclosure CVE-2017-20031 2.7 LowJune 10, 2022
• phplist PHPList Sending Campain sql injection CVE-2017-20030 4.7 MediumJune 10, 2022
• phplist PHPList Edit Subscription index.php sql injection CVE-2017-20029 EPSS 21.0% 7.3 HighJune 10, 2022
• phplist Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file... CVE-2020-22249 9.8 CriticalJuly 6, 2021
• phplist Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage... CVE-2020-22251 Fix available 4.8 MediumJuly 6, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to... CVE-2020-36399 Fix available 5.4 MediumJuly 2, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to... CVE-2020-36398 Fix available 5.4 MediumJuly 2, 2021
• phplist A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist... CVE-2020-23194 Fix available 5.4 MediumJuly 2, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated... CVE-2020-23192 Fix available 5.4 MediumJuly 2, 2021
• phplist A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4... CVE-2020-23190 5.4 MediumJuly 2, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute... CVE-2020-23217 5.4 MediumJuly 1, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute... CVE-2020-23214 5.4 MediumJuly 1, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute... CVE-2020-23209 5.4 MediumJuly 1, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute... CVE-2020-23208 5.4 MediumJuly 1, 2021
• phplist A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute... CVE-2020-23207 5.4 MediumJuly 1, 2021
• phplist phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for... CVE-2020-23361 9.8 CriticalJanuary 27, 2021
• phplist phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. CVE-2021-3188 9.8 CriticalJanuary 21, 2021
• phplist phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the ... CVE-2020-35708 7.2 HighDecember 25, 2020
• phplist An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability... CVE-2020-15072 Fix available 8.8 HighJuly 8, 2020
• phplist An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import... CVE-2020-15073 Fix available 5.4 MediumJuly 8, 2020
• phplist phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. CVE-2020-13827 Fix available 6.1 MediumJune 4, 2020
• phplist phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. CVE-2020-12639 Fix available 6.1 MediumMay 4, 2020
• phplist phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for... CVE-2020-8547 Public exploit 9.8 CriticalFebruary 3, 2020
• phplist Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in... CVE-2014-2916 6.8 MediumMay 5, 2014
• phplist Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18... CVE-2012-2741 Public exploit 4.3 MediumSeptember 6, 2012
• phplist SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote... CVE-2012-2740 Public exploit 7.5 HighSeptember 6, 2012
• phplist Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2... CVE-2012-4247 Public exploit 4.3 MediumAugust 12, 2012
• phplist Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2... CVE-2012-4246 Public exploit 4.3 MediumAugust 12, 2012
• phplist SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote... CVE-2012-3953 Public exploit 7.5 HighAugust 12, 2012
• phplist Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows... CVE-2012-3952 Public exploit 2.6 LowAugust 12, 2012
• fckeditor, phplist +1 more Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php... CVE-2008-6178 Public exploit 7.5 HighFebruary 19, 2009
• phplist Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers... CVE-2006-5524 Public exploit 6.8 MediumOctober 26, 2006
• phplist mailing list manager Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack... CVE-2004-2744 5.0 MediumDecember 31, 2004