Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2025-28073: phpList Before 3.6.15 Allows Malicious Code Injection via URL Hack
CVE-2025-28073 · published 1 year ago
Summary
Malicious users can inject code into phpList's download page, potentially stealing user data or taking control of accounts. This affects phpList versions prior to 3.6.15. Update to the latest version to fix the issue.
What to do
- Update phplist phplist to version 3.6.15 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| phplist | phplist |
< 3.6.15 cpe:2.3:a:phplist:phplist:*:*:*:*:*:*:*:* |
Original advisory text
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which ...
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.
References
- https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15 URL
- https://www.phplist.org/newslist/phplist-3-6-15-release-notes/ URL
- https://github.com/mLniumm/CVE-2025-28073 Product
- https://github.com/phpList/phplist3 Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/28xxx/CVE-2025-28073... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-28073 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published8 May 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta