CVE-2026-92806

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

EUVD-2026-81066

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

CVE-2026-92806: Cross-Site Request Forgery (CSRF)

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...

PT-2026-94080

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.6.17 Description The mass subscriber removal form handler fails to validate cross-site request forgery CSRF tokens. CSRF is a type of attack that tricks a victim into submitting a malicious request. This allows...