Skip to content
OpenAdvisories

Vendor

knadh

6 known vulnerabilities.

Products

listmonk 6
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.5
    CVE-2026-62361

    listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without call…

    knadh listmonk github.com/knadh/listmonk Go
  • Medium 5.4
    CVE-2026-34584

    listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists (which they don't have access to) under differen…

    knadh listmonk
  • Medium 5.4
    CVE-2026-21483

    listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

    listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Ad…

    knadh listmonk github.com/knadh/listmonk Go