PH
Product
phpList
41
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 4Medium 21Low 1
Watch
Add phpList to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-20032 | 9.8 | Jun 10 | A vulnerability was found in PHPList 3.2.6 Affected: 3.2.6 |
| CVE-2017-20029 | 9.8 | Jun 10 | A vulnerability was found in PHPList 3.2.6 and classified as critical Affected: 3.2.6 |
| CVE-2020-22249 | 9.8 | Jul 6 | Remote Code Execution vulnerability in phplist 3.5.1 Affected: 3.5.1 |
| CVE-2020-23361 | 9.8 | Jan 27 | phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively… Affected: 3.5.3 |
| CVE-2021-3188 | 9.8 | Jan 26 | phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports Affected: 3.6.0 |
| CVE-2020-8547 | 9.8 | Feb 3 | phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively… Affected: 3.5.0 |
| CVE-2020-15072 | 8.8 | Jul 8 | An issue was discovered in phpList through 3.5.4 Affected: through 3.5.4 |
| CVE-2026-92806 | 8.1 | Sep 16 | phpList before 3.6.17 Cross-Site Request Forgery via massremove.php Affected: before 3.6.17 |
| CVE-2017-20030 | 7.2 | Jun 10 | A vulnerability was found in PHPList 3.2.6 Affected: 3.2.6 |
| CVE-2020-35708 | 7.2 | Dec 25 | phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page Affected: 3.5.9 |
| CVE-2023-27576 | 6.7 | Aug 18 | An issue was discovered in phpList before 3.6.14 Affected: 3.6.12 |
| CVE-2025-28073 | 6.1 | May 8 | phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint Affected: before 3.6.15 |
| CVE-2025-28074 | 6.1 | May 8 | phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php Affected: before 3.6.15 |
| CVE-2017-20033 | 6.1 | Jun 10 | A vulnerability classified as problematic has been found in PHPList 3.2.6 Affected: 3.2.6 |
| CVE-2020-13827 | 6.1 | Jun 4 | phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php Affected: before 3.5.4 |
| CVE-2020-12639 | 6.1 | May 4 | phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php Affected: before 3.5.3 |
| CVE-2017-20036 | 5.4 | Jun 10 | A vulnerability, which was classified as problematic, was found in PHPList 3.2.6 Affected: 3.2.6 |
| CVE-2017-20035 | 5.4 | Jun 10 | A vulnerability, which was classified as problematic, has been found in PHPList 3.2.6 Affected: 3.2.6 |
| CVE-2017-20034 | 5.4 | Jun 10 | A vulnerability classified as problematic was found in PHPList 3.2.6 Affected: 3.2.6 |
| CVE-2020-36399 | 5.4 | Jul 2 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1"… Affected: through 3.5.4 |
| CVE-2020-36398 | 5.4 | Jul 2 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign"… Affected: through 3.5.4 |
| CVE-2020-23194 | 5.4 | Jul 2 | A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or… Affected: through 3.5.4 |
| CVE-2020-23192 | 5.4 | Jul 2 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the… Affected: through 3.5.4 |
| CVE-2020-23190 | 5.4 | Jul 2 | A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a… Affected: 3.5.4 |
| CVE-2020-23217 | 5.4 | Jul 1 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list"… Affected: 3.5.3 |
| CVE-2020-23214 | 5.4 | Jul 1 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure… Affected: 3.5.3 |
| CVE-2020-23209 | 5.4 | Jul 1 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List… Affected: 3.5.3 |
| CVE-2020-23208 | 5.4 | Jul 1 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test"… Affected: 3.5.3 |
| CVE-2020-23207 | 5.4 | Jul 1 | A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Edit Values"… Affected: 3.5.3 |
| CVE-2020-15073 | 5.4 | Jul 8 | An issue was discovered in phpList through 3.5.4 Affected: through 3.5.4 |
| CVE-2020-22251 | 4.8 | Jul 6 | Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin Affected: through 3.5.3 |
| CVE-2017-20031 | 2.7 | Jun 10 | A vulnerability was found in PHPList 3.2.6 Affected: 3.2.6 |
| CVE-2014-2916 | – | May 5 | Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of… Affected: through 3.0.5; 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4 |
| CVE-2012-2741 | – | Sep 6 | Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter… Affected: through 2.10.17; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; +10 more |
| CVE-2012-2740 | – | Sep 6 | SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find… Affected: through 2.10.17; 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; +10 more |
| CVE-2012-4247 | – | Aug 12 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1)… Affected: through 2.10.18; 2.6.5; 2.7.1; 2.7.2; 2.8.2; 2.8.7; +17 more |
| CVE-2012-4246 | – | Aug 12 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1)… Affected: through 2.10.18; 2.6.5; 2.7.1; 2.7.2; 2.8.2; 2.8.7; +17 more |
| CVE-2012-3953 | – | Aug 12 | SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the… Affected: through 2.10.18; 2.6.5; 2.7.1; 2.7.2; 2.8.2; 2.8.7; +17 more |
| CVE-2012-3952 | – | Aug 12 | Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter… Affected: through 2.10.18; 2.6.5; 2.7.1; 2.7.2; 2.8.2; 2.8.7; +17 more |
| CVE-2008-6178 | – | Feb 19 | Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products,… Affected: 2.10.1; 2.10.2; 2.10.3; 2.10.4; 2.10.5; 2.10.6 |
| CVE-2006-5524 | – | Oct 26 | Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter Affected: 2.10.2 |
Showing 41