CVE-2026-73482 | High | 8.1 | 2026-08-13 | phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered v… |
CVE-2026-73481 | Medium | 5.4 | 2026-08-13 | phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint (bouncerules.php / bouncerule.php). The deletion is perform… |
CVE-2025-28074 | Medium | 6.1 | 2025-05-08 | phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the appli… |
CVE-2025-28073 | Medium | 6.1 | 2025-05-08 | phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by… |
CVE-2023-27576 | Medium | 6.7 | 2023-08-18 | An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system's super admin, allowing one… |
CVE-2017-20036 | Low | 3.5 | 2022-06-10 | A vulnerability, which was classified as problematic, was found in PHPList 3.2.6. Affected is an unknown function of the file /lists/admin/ of the component Bo… |
CVE-2017-20035 | Low | 3.5 | 2022-06-10 | A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6. This issue affects some unknown processing of the file /lists/admin/ of… |
CVE-2017-20034 | Low | 3.5 | 2022-06-10 | A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List N… |
CVE-2017-20033 | Medium | 4.3 | 2022-06-10 | A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argu… |
CVE-2017-20032 | Medium | 6.3 | 2022-06-10 | A vulnerability was found in PHPList 3.2.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subscription… |
CVE-2017-20031 | Low | 2.7 | 2022-06-10 | A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation o… |
CVE-2017-20030 | Medium | 4.7 | 2022-06-10 | A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Send… |
CVE-2017-20029 | High | 7.3 | 2022-06-10 | A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component… |
CVE-2020-22251 | Medium | 4.8 | 2021-07-06 | Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin. |
CVE-2020-22249 | Critical | 9.8 | 2021-07-06 | Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious p… |
CVE-2020-36399 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2020-36398 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2020-23194 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbi… |
CVE-2020-23192 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2020-23190 | Medium | 5.4 | 2021-07-02 | A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web script… |
CVE-2020-23217 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23214 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23209 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23208 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23207 | Medium | 5.4 | 2021-07-01 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into… |
CVE-2020-23361 | Critical | 9.8 | 2021-01-27 | phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed… |
CVE-2021-3188 | Critical | 9.8 | 2021-01-26 | phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. |
CVE-2020-35708 | High | 7.2 | 2020-12-25 | phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page. |
CVE-2020-15073 | Medium | 5.4 | 2020-07-08 | An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. T… |
CVE-2020-15072 | High | 8.8 | 2020-07-08 | An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section. |
CVE-2020-13827 | Medium | 6.1 | 2020-06-04 | phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. |
CVE-2020-12639 | Medium | 6.1 | 2020-05-04 | phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. |
CVE-2020-8547 | Critical | 9.8 | 2020-02-03 | phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e fol… |
CVE-2014-2916 | | | 2014-05-05 | Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authe… |
CVE-2012-2741 | | | 2012-09-06 | Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML v… |
CVE-2012-2740 | | | 2012-09-06 | SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby param… |
CVE-2012-4247 | | | 2012-08-12 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or… |
CVE-2012-4246 | | | 2012-08-12 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or… |
CVE-2012-3953 | | | 2012-08-12 | SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete paramete… |
CVE-2012-3952 | | | 2012-08-12 | Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the un… |
CVE-2008-6178 | | | 2009-02-19 | Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and… |
CVE-2006-5524 | | | 2006-10-26 | Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NO… |
CVE-2004-2744 | | | 2004-12-31 | Unspecified vulnerability in Tincan Limited PHPlist before 2.8.12 has unknown impact and attack vectors, related to a "security update release." |