phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.

Published May 4, 2020 · Updated Aug 4, 2024 · Assigned by mitre