Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

PHPlist PHPListXSS

Risk 22
Severity
4.3
XSS
AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

First published (updated )
CVE-2012-4246

PHPlist PHPListXSS

Risk 22
Severity
4.3
XSS
AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remoteuser, (2) remotedatabase, (3) remoteuserprefix, (4) remotepassword, or (5) remoteprefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.

First published (updated )
CVE-2012-4247

Tincan PhplistXSS, CSRF

Risk 22
Severity
4.3
XSS, CSRF
AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create a list or (2) insert cross-site scripting (XSS) sequences. NOTE: this issue exists because of an incomplete fix for CVE-2011-0748. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

First published (updated )
CVE-2011-1682

Tincan PhplistCSRF

Risk 47
Severity
6.8
CSRF
AV:N/AC:M/Au:N/C:P/I:P/A:P

Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) edit administrator accounts.

First published (updated )
CVE-2011-0748

Tincan PhplistXSS

Risk 22
Severity
4.3
XSS
AV:N/AC:M/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information.

First published (updated )
CVE-2012-5228

PHPlist PHPListSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.

First published (updated )
CVE-2012-3953

PHPlist PHPListXSS

Risk 15
Severity
2.6
XSS
AV:N/AC:H/Au:N/C:N/I:P/A:N

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

First published (updated )
CVE-2012-3952

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203