4 matches found
CVE-2026-92806
phpList versions before 3.6.17 are vulnerable to Cross-Site Request Forgery (CSRF) in the mass subscriber removal form handler (massremove.php). The root cause is the absence of CSRF token validation, allowing an attacker to craft a page that, when visited by a logged-in administrator, triggers s...
CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...
CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...
CVE-2026-92806 phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification...