CVE-2015-2775

CVE-2015-2775 is a directory traversal vulnerability in GNU Mailman up to version 2.1.19, exploitable via a leading .. in a list name when not using a static alias. The underlying issue is improper validation of list-name input, enabling remote attackers to execute arbitrary files. Impact is remo...

CVE-2025-43919

CVE-2025-43919 affects GNU Mailman 2.1.39 bundled with cPanel/WHM. The vulnerability is a directory traversal in the /mailman/private/mailman endpoint, exploitable via a crafted username parameter that can read arbitrary server files (e.g., /etc/passwd). Root cause: insufficient input validation ...

CVE-2005-4153

CVE-2005-4153 affects Mailman 2.1.4–2.1.6, where a crafted message with bad date data could crash the Mailman server (remote DoS). Root cause: improper handling of date data in processed messages. Exploitation details are not provided in the included documents. Remediation in connected advisories...

CVE-2006-2191

The CVE-2006-2191 entry concerns a format-string vulnerability in Mailman prior to version 2.1.9, which could allow an attacker to execute arbitrary code via unspecified vectors. The vulnerability is documented across multiple advisories and OpenVAS/Nessus entries, and several sources explicitly ...

CVE-2002-0855

CVE-2002-0855 describes a cross-site scripting vulnerability in Mailman prior to 2.0.12. Theissue allows remote attackers to execute script as other users by crafting a subscriber’s list subscription options in the ml-name feature via the (1) adminpw or (2) info parameters. Connected advisories c...

CVE-2001-1132

Vulnerability details (CVE-2001-1132) : Mailman 2.0.x prior to 2.0.6 is vulnerable. During authentication, an empty site or list password is not properly handled when calling the crypt function, enabling remote attackers to gain access to list administrative pages. This is limited to the affected...

CVE-2002-0388

CVE-2002-0388 affects Mailman releases prior to 2.0.11, enabling remote XSS via the admin login page or Pipermail index summaries. The root cause is cross-site scripting in Mailman’s web interfaces. Public advisories and OpenVAS/Nessus entries corroborate a fix in 2.0.11 (debian/DSA-147-1/DSA-147...

CVE-2000-0861

CVE-2000-0861 affects Mailman 1.1. The vulnerability allows a list administrator to execute arbitrary commands by injecting shell metacharacters into the %(listname) macro expansion. The root cause is improper handling of the macro expansion, enabling command execution with LOCAL attack vector an...

CVE-2004-1143

The CVE-2004-1143 issue concerns Mailman prior to version 2.1.5, where auto-generated passwords are limited to about 5 million, enabling remote attackers to perform brute-force guessing of subscriber credentials. Remediation: upgrade to Mailman 2.1.5 or newer (as detailed in related advisories). ...