CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/07/2021 |
| CVE-2020-23361 | 심각9.8 | phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. | 27/01/2021 |
| CVE-2021-3188 | 심각9.8 | phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. | 26/01/2021 |
| CVE-2020-35708 | 높음7.2 | phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page. | 25/12/2020 |
| CVE-2020-15073 | 보통5.4 | An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section. | 08/07/2020 |
| CVE-2020-15072 | 높음8.8 | An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section. | 08/07/2020 |
| CVE-2020-13827 | 보통6.1 | phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. | 04/06/2020 |
| CVE-2020-12639 | 보통6.1 | phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php. | 04/05/2020 |
| CVE-2020-8547 | 심각9.8 | phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. | 03/02/2020 |
| CVE-2014-2916 | 보통6.8 | Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/. | 05/05/2014 |
| CVE-2012-2741 | 보통4.3 | Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action. | 06/09/2012 |
| CVE-2012-2740 | 높음7.5 | SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action. | 06/09/2012 |
| CVE-2012-4247 | 보통4.3 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id | 12/08/2012 |
| CVE-2012-4246 | 보통4.3 | Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page. | 12/08/2012 |
| CVE-2012-3953 | 높음7.5 | SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page. | 12/08/2012 |
| CVE-2012-3952 | 낮음2.6 | Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page. | 12/08/2012 |
| CVE-2008-6178 | 높음7.5 | Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allows remote attackers to execute arbitrary code by creating a file with PHP sequences preceded by a ZIP header, uploading this file via a FileU | 19/02/2009 |
| CVE-2006-5524 | 보통6.8 | Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: This issue might overlap CVE-2006-5321. | 26/10/2006 |