U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Results Type: Overview
  • Keyword (text search): cpe:2.3:a:phplist:phplist:2.10.14:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 16 matching records.
Displaying matches 1 through 16.
Vuln ID Summary CVSS Severity
CVE-2020-22251

Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.

Published: July 06, 2021; 4:15:07 PM -0400 		V3.1: 4.8 MEDIUM
 V2.0: 3.5 LOW
CVE-2020-36399

A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module.

Published: July 02, 2021; 2:15:08 PM -0400 		V3.1: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2020-36398

A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "Campaign" field under the "Send a campaign" module.

Published: July 02, 2021; 2:15:08 PM -0400 		V3.1: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2020-23194

A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.

Published: July 02, 2021; 2:15:08 PM -0400 		V3.1: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2020-23192

A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.

Published: July 02, 2021; 2:15:08 PM -0400 		V3.1: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2020-15073

An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.

Published: July 08, 2020; 4:15:10 PM -0400 		V3.1: 5.4 MEDIUM
 V2.0: 3.5 LOW
CVE-2020-15072

An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.

Published: July 08, 2020; 4:15:10 PM -0400 		V3.1: 8.8 HIGH
 V2.0: 6.5 MEDIUM
CVE-2020-13827

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.

Published: June 04, 2020; 11:15:13 AM -0400 		V3.1: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2020-12639

phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.

Published: May 04, 2020; 10:15:13 AM -0400 		V3.1: 6.1 MEDIUM
 V2.0: 4.3 MEDIUM
CVE-2014-2916

Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.

Published: May 05, 2014; 12:07:06 PM -0400 		V3.x:(not available)
 V2.0: 6.8 MEDIUM
CVE-2012-2741

Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.

Published: September 06, 2012; 1:55:01 PM -0400 		V3.x:(not available)
 V2.0: 4.3 MEDIUM
CVE-2012-2740

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.

Published: September 06, 2012; 1:55:01 PM -0400 		V3.x:(not available)
 V2.0: 7.5 HIGH
CVE-2012-4247

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.

Published: August 11, 2012; 8:55:01 PM -0400 		V3.x:(not available)
 V2.0: 4.3 MEDIUM
CVE-2012-4246

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

Published: August 11, 2012; 8:55:01 PM -0400 		V3.x:(not available)
 V2.0: 4.3 MEDIUM
CVE-2012-3953

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

Published: August 11, 2012; 8:55:00 PM -0400 		V3.x:(not available)
 V2.0: 7.5 HIGH
CVE-2012-3952

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

Published: August 11, 2012; 8:55:00 PM -0400 		V3.x:(not available)
 V2.0: 2.6 LOW