CVE-2025-28074

CVE-2025-28074 Suggested description phpList prior to 3.6.3 is vulnerable to Cross-Site Scripting XSS due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing ...

Cross-site Scripting (XSS)

Overview phpList/phplist3 is a popular open source newsletter manager. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization in lt.php. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...

CVE-2025-28074: Improper Neutralization of Input During Web Page Generation

phpList before 3.6.15 is vulnerable to Cross-Site Scripting XSS due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious...

Exploit for Cross-site Scripting in Phplist

CVE-2025-28074 Suggested description phpList prior to 3.6.3...