CVE-2025-28073: XSS
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-28073?
CVE-2025-28073 is considered a high-severity vulnerability due to its potential for reflected cross-site scripting.
How do I fix CVE-2025-28073?
To fix CVE-2025-28073, ensure that all input parameters, particularly the id parameter in /lists/dl.php, are properly sanitized and validated.
Who is affected by CVE-2025-28073?
CVE-2025-28073 affects users of phpList version 3.6.3 and possibly earlier versions if they use the vulnerable endpoint.
What type of attack can exploit CVE-2025-28073?
CVE-2025-28073 can be exploited through reflected cross-site scripting, allowing attackers to execute arbitrary JavaScript in users' browsers.
What steps can I take to mitigate CVE-2025-28073?
Mitigation for CVE-2025-28073 includes updating to the latest secure version of phpList and implementing input validation measures on user inputs.