Skip to content
Noroxi

phplist records

41 published records for vendor phplist.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
4
With a fix record
19.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 21
  3. 22
  4. 23
  5. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

41 records
  • CVE-2017-20029
    45Plan

    PHPList Edit Subscription index.php sql injection

    CriticalCVSS 9.8No exploitEPSS 21%

    phplist · phplistJun 10, 2022

  • CVE-2020-8547
    41Plan

    phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes tha

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    phplist · phplistFeb 3, 2020

  • CVE-2020-22249
    40Plan

    Remote Code Execution vulnerability in phplist 3.5.1.

    CriticalCVSS 9.8No exploitEPSS 2%

    phplist · phplistJul 6, 2021

  • CVE-2021-3188
    40Plan

    phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports.

    CriticalCVSS 9.8No exploitEPSS 1%

    phplist · phplistJan 26, 2021

  • CVE-2020-23361
    39Monitor

    phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begi

    CriticalCVSS 9.8No exploitEPSS 1%

    phplist · phplistJan 27, 2021

  • CVE-2017-20032
    39Monitor

    PHPList Subscription sql injection

    CriticalCVSS 9.8No exploitEPSS 0%

    phplist · phplistJun 10, 2022

  • CVE-2020-15072
    35Monitor

    An issue was discovered in phpList through 3.5.4.

    HighCVSS 8.8No exploitEPSS 1%

    phplist · phplistJul 8, 2020

  • CVE-2008-6178
    32Monitor

    Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4

    HighCVSS 7.5Proof of conceptEPSS 7%

    fckeditor · fckeditorFeb 19, 2009

  • CVE-2012-2740
    31Monitor

    SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands v

    HighCVSS 7.5Proof of conceptEPSS 3%

    phplist · phplistSep 6, 2012

  • CVE-2012-3953
    30Monitor

    SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via

    HighCVSS 7.5Proof of conceptEPSS 1%

    phplist · phplistAug 11, 2012

  • CVE-2006-5524
    28Monitor

    Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via t

    MediumCVSS 6.8Proof of conceptEPSS 2%

    phplist · phplistOct 26, 2006

  • CVE-2020-35708
    28Monitor

    phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.

    HighCVSS 7.2No exploitEPSS 1%

    phplist · phplistDec 25, 2020

  • CVE-2017-20030
    28Monitor

    PHPList Sending Campain sql injection

    HighCVSS 7.2No exploitEPSS 0%

    phplist · phplistJun 10, 2022

  • CVE-2014-2916
    27Monitor

    Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers

    MediumCVSS 6.8No exploitEPSS 1%

    phplist · phplistMay 5, 2014

  • CVE-2023-27576
    26Monitor

    An issue was discovered in phpList before 3.6.14.

    MediumCVSS 6.7No exploitEPSS 0%

    phplist · phplistAug 18, 2023

  • CVE-2020-13827
    24Monitor

    phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.

    MediumCVSS 6.1No exploitEPSS 0%

    phplist · phplistJun 4, 2020

  • CVE-2017-20033
    24Monitor

    PHPList Reflected cross site scriting

    MediumCVSS 6.1No exploitEPSS 0%

    phplist · phplistJun 10, 2022

  • CVE-2020-12639
    24Monitor

    phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.

    MediumCVSS 6.1No exploitEPSS 0%

    phplist · phplistMay 4, 2020

  • CVE-2025-28073
    24Monitor

    phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    phplist · phplistMay 8, 2025

  • CVE-2025-28074
    24Monitor

    phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    phplist · phplistMay 8, 2025

  • CVE-2020-15073
    21Monitor

    An issue was discovered in phpList through 3.5.4.

    MediumCVSS 5.4No exploitEPSS 0%

    phplist · phplistJul 8, 2020

  • CVE-2017-20034
    21Monitor

    PHPList List Name Persistent cross site scriting

    MediumCVSS 5.4No exploitEPSS 0%

    phplist · phplistJun 10, 2022

  • CVE-2017-20035
    21Monitor

    PHPList Subscribe Persistent cross site scriting

    MediumCVSS 5.4No exploitEPSS 0%

    phplist · phplistJun 10, 2022

  • CVE-2017-20036
    21Monitor

    PHPList Bounce Rule Persistent cross site scriting

    MediumCVSS 5.4No exploitEPSS 0%

    phplist · phplistJun 10, 2022

  • CVE-2020-23217
    21Monitor

    A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted p

    MediumCVSS 5.4No exploitEPSS 0%

    phplist · phplistJul 1, 2021