CVE-2025-28073

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized...

CVE-2025-28073

CVE-2025-28073 affects phpList before 3.6.15. The issue is a Reflected Cross-Site Scripting (XSS) in /lists/dl.php where the id parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript and potentially perform actions in the victim’s browser. Documented impact inclu...