Skip to content
OpenAdvisories

Package · Go

github.com/knadh/listmonk

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-62361

    listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without call…

    knadh listmonk github.com/knadh/listmonk Go
  • Medium 5.4
    CVE-2026-21483

    listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Ad…

    knadh listmonk github.com/knadh/listmonk Go