CVE-2025-28074

The phpList newsletter manager (versions prior to 3.6.15 ) is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in the lt.php component. The root cause is the application's failure to escape untrusted input when dynamically referencing internal paths, allowing an attacke...