Phplist@2.10.1 Security Vulnerabilities and Issues — Phplist@2.10.1 CVE List

Lucene search

PhplistPhplist2.10.1

7 matches found

CVE•added 2012/08/12 12:55 a.m.•50 views

CVE-2012-3953

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

7.5CVSS8.5AI score0.00605EPSS

CVE•added 2012/08/12 12:55 a.m.•49 views

CVE-2012-3952

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

2.6CVSS5.8AI score0.0661EPSS

CVE•added 2009/02/19 4:30 p.m.•43 views

CVE-2008-6178

Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading ...

7.5CVSS7.9AI score0.07509EPSS

CVE•added 2012/09/06 5:55 p.m.•40 views

CVE-2012-2740

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.

7.5CVSS8.4AI score0.03204EPSS

CVE•added 2012/09/06 5:55 p.m.•40 views

CVE-2012-2741

Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.

4.3CVSS5.7AI score0.07984EPSS

CVE•added 2012/08/12 12:55 a.m.•33 views

CVE-2012-4247

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import...

4.3CVSS5.9AI score0.04779EPSS

CVE•added 2012/08/12 12:55 a.m.•32 views

CVE-2012-4246

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

4.3CVSS5.9AI score0.0567EPSS