📦

phplist

Vendor: phplist

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 9 Code Available
Total RCEs 2 Remote Access
Total CVEs 65 Total Indexed
Avg. EPSS 1.87% Exploit Prob.
Latest CVE CVE-2025-28074 May 08

Security Vulnerability Index

Page 4 / 7
9.8 CVSS
CVE-2020-8547
Exploit Found

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

EPSS: 5.86%
6.8 CVSS
CVE-2014-2916

Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.

EPSS: 1.08%
4.3 CVSS
CVE-2012-2741
Exploit Found

Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.

EPSS: 2.86%
7.5 CVSS
CVE-2012-2740
Exploit Found

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.

EPSS: 3.33%
4.3 CVSS
CVE-2012-4247
Exploit Found

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.

EPSS: 2.06%
4.3 CVSS
CVE-2012-4246
Exploit Found

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

EPSS: 1.86%
7.5 CVSS
CVE-2012-3953
Exploit Found

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

EPSS: 1.12%
2.6 CVSS
CVE-2012-3952
Exploit Found

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

EPSS: 1.93%
7.5 CVSS
CVE-2008-6178
RCE Exploit Found

Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileUpload action with the application/zip content type, and then accessing this file via a direct request to the file in UserFiles/File/, probably a related issue to CVE-2005-4094. NOTE: some of these details are obtained from third party information.

EPSS: 7.81%
6.8 CVSS
CVE-2006-5524
Exploit Found

Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: This issue might overlap CVE-2006-5321.

EPSS: 2.09%