CVE-2026-73482: Cross-Site Request Forgery (CSRF)

phpList before 3.7.0-RC5 contains a cross-site request forgery CSRF vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request ?page=admins&delete=N that is not protected by a CSRF token the central verifyCsrfGetToken check uses...

CVE-2017-20034

A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting Persistent. The attack can be initiated remotely. Upgrading to version 3.3.1 is able t...

CVE-2017-20030

A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Sending Campain. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the...

PT-2022-7908

Name of the Vulnerable Software and Affected Versions PHPList version 3.2.6 Description A problematic issue has been found in the Subscribe component of PHPList, affecting the processing of the file /lists/admin/. This leads to cross site scripting Persistent and can be initiated remotely...

PT-2022-7907

Name of the Vulnerable Software and Affected Versions PHPList version 3.2.6 Description A vulnerability was found in the component List Name, affecting unknown code of the file /lists/admin/. The manipulation leads to cross site scripting Persistent and can be initiated remotely. Recommendations...

PT-2022-7906

Name of the Vulnerable Software and Affected Versions PHPList versions 3.2.6 Description A problematic issue has been found in PHPList, affecting an unknown part of the file /lists/admin/. The manipulation of the page argument with the input send'";alert8 leads to cross site scripting Reflected. ...

CVE-2017-20034: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability classified as problematic was found in PHPList 3.2.6. This vulnerability affects unknown code of the file /lists/admin/ of the component List Name. The manipulation leads to cross site scripting Persistent. The attack can be initiated remotely. Upgrading to version 3.3.1 is able t...

CVE-2022-29669

CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/news/admin/lists/zhuan...

CVE-2021-3188

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports...

CVE-2021-3188: Improper Neutralization of Formula Elements in a CSV File

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports...

CVE-2020-13827

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...

CVE-2020-12639

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...

CVE-2020-12639

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...

CVE-2020-12639: Improper Neutralization of Input During Web Page Generation

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...

PT-2012-4228

Name of the Vulnerable Software and Affected Versions phpList versions prior to 2.10.18 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the num parameter in a "reconcileusers" actio...

CVE-2012-4247: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the 1 remoteuser, 2 remotedatabase, 3 remoteuserprefix, 4 remotepassword, or 5 remoteprefix parameter to the import4 page; or the ...

CVE-2012-4246: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the 1 page parameter; or the 2 footer, 3 status, or 4 testtarget parameter in the send page...

CVE-2005-2433: Undefined Security Weakness

PhpList allows remote attackers to obtain sensitive information via a direct request to 1 about.php, 2 connect.php, 3 domainstats.php or 4 usercheck.php in publichtml/lists/admin directory, 5 attributes.php, 6 dbcheck.php, 7 importcsv.php, 8 user.php, 9 usermgt.php, or 10 users.php in...