Skip to content
OpenAdvisories

Vendor

phplist

3 known vulnerabilities.

Products

phplist3 2 phpList 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-92806

    phpList before 3.6.17 Cross-Site Request Forgery via massremove.php

    phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber address…

    phplist phpList
  • High 8.1
    CVE-2026-73482

    phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php

    phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the…

    phplist phplist3