Medium severity · published May 8, 2025
CVE-2025-28074
phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious JavaScript.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Phplist · Phplist
before 3.6.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-28074
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-28074
Third Party Advisory
https://github.com/mLniumm/CVE-2025-28074
Product
https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.php
Product
https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15
Release Notes
https://www.phplist.org/newslist/phplist-3-6-15-release-notes/
More from Phplist
9.8
CVE-2017-20032
A vulnerability was found in PHPList 3.2.6
9.8
CVE-2017-20029
A vulnerability was found in PHPList 3.2.6 and classified as critical
9.8
CVE-2020-22249
Remote Code Execution vulnerability in phplist 3.5.1
9.8
CVE-2020-23361
phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively…
9.8
CVE-2021-3188
phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports