Show filters
62 Total Results
Displaying 31-40 of 62
Sort by:
Attacker Value
Unknown
CVE-2020-12639
Disclosure Date: May 04, 2020 (last updated February 21, 2025)
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php.
0
Attacker Value
Unknown
CVE-2020-8547
Disclosure Date: February 03, 2020 (last updated November 27, 2024)
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
0
Attacker Value
Unknown
CVE-2015-3345
Disclosure Date: April 21, 2015 (last updated October 05, 2023)
SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database."
0
Attacker Value
Unknown
CVE-2014-2916
Disclosure Date: May 05, 2014 (last updated October 05, 2023)
Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.
0
Attacker Value
Unknown
CVE-2012-5228
Disclosure Date: October 01, 2012 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information.
0
Attacker Value
Unknown
CVE-2012-2740
Disclosure Date: September 06, 2012 (last updated October 05, 2023)
SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action.
0
Attacker Value
Unknown
CVE-2012-2741
Disclosure Date: September 06, 2012 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a reconcileusers action.
0
Attacker Value
Unknown
CVE-2012-3952
Disclosure Date: August 12, 2012 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
0
Attacker Value
Unknown
CVE-2012-3953
Disclosure Date: August 12, 2012 (last updated October 04, 2023)
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page.
0
Attacker Value
Unknown
CVE-2012-4247
Disclosure Date: August 12, 2012 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.
0
