CVE-2026-73482: Cross-Site Request Forgery (CSRF)

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2017-20030

A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Sending Campain. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

CVE-2017-20034

A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting Persistent. The attack can be initiated remotely. Upgrading to version 3.3.1 is able t...

CVE-2017-20034: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting Persistent. The attack can be initiated remotely. Upgrading to version 3.3.1 is able t...

CVE-2022-29669

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan...

CVE-2021-3188: Improper Neutralization of Formula Elements in a CSV File

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports...

CVE-2020-12639

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...

CVE-2020-12639: Improper Neutralization of Input During Web Page Generation

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...