Sploitus

50 exploited vulnerabilities in Phplist

Vulnerabilities with publicly known exploits

Vendors
Phplist, Php
With known exploits
50
Affected Phplist versions
= 3.5.0, 2.10.18, 2.6.5, 2.7.1, 2.7.2, 2.8.2, 2.8.7, 2.8.12, 2.10.1, 2.10.2, 2.10.3, 2.10.4, 2.10.5, 2.10.7, 2.10.8, 2.10.9, 2.10.10, 2.10.11, 2.10.12, 2.10.13, 2.10.14, 2.10.15, 2.10.16, 2.10.17, 3.6.15
Affected Tincan Phplist versions
All versions

Vulnerabilities with exploits

Highest CVSS first — 18 of these already have exploit code on Sploitus

CVE-2021-3188
CVSS 10.0 CRITICAL 2021-01-21FIX AVAILABLE
CVE-2020-22249
CVSS 10.0 CRITICAL 2021-07-06
CVE-2017-20032
CVSS 9.8 CRITICAL 2022-06-10FIX AVAILABLE
CVE-2017-20029
CVSS 9.8 CRITICAL 2022-06-10FIX AVAILABLE
CVE-2020-23361
CVSS 9.8 CRITICAL 2021-01-27FIX AVAILABLE
CVE-2020-8547 2 exploits
CVSS 9.8 CRITICAL 2020-02-03FIX AVAILABLE
phpList 3.5.0 - Authentication BypassphpList 3.5.0 - Authentication Bypass
CVE-2020-15072
CVSS 8.8 HIGH 2020-07-08FIX AVAILABLE
CVE-2012-3953 3 exploits
CVSS 7.5 HIGH 2012-08-12FIX AVAILABLE
phpList 2.10.18 Cross Site Scripting / SQL Injection VulnerabilityphpList 2.10.18 Cross Site Scripting / SQL Injection
CVE-2012-2740 1 exploit
CVSS 7.5 HIGH 2012-09-06FIX AVAILABLE
phpList 2.10.17 - SQL Injection / Cross-Site Scripting
CVE-2009-0422 1 exploit
CVSS 7.5 HIGH 2009-02-05FIX AVAILABLE
phpList 2.10.8 - Local File Inclusion
CVE-2005-2432 1 exploit
CVSS 7.5 HIGH 2005-08-03
phpList 2.8.12 - Admin Page SQL Injection
CVE-2017-20030
CVSS 7.2 HIGH 2022-06-10FIX AVAILABLE
CVE-2020-35708
CVSS 7.2 HIGH 2020-12-25
CVE-2014-2916
CVSS 6.8 MEDIUM 2014-05-05FIX AVAILABLE
CVE-2011-0748 1 exploit
CVSS 6.8 MEDIUM 2011-04-13FIX AVAILABLE
phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2007-5167
CVSS 6.8 MEDIUM 2007-10-01FIX AVAILABLE
CVE-2006-5524 1 exploit
CVSS 6.8 MEDIUM 2006-10-26
phpList 2.10.2 - 'index.php' Cross-Site Scripting
CVE-2023-27576
CVSS 6.7 MEDIUM 2023-08-18FIX AVAILABLE
CVE-2005-3555 2 exploits
CVSS 6.5 MEDIUM 2005-11-16
PHPList Mailing List Manager 2.x - '/admin/admin.php?id' SQL InjectionPHPList Mailing List Manager 2.x - '/admin/editattributes.php?id' SQL Injection
CVE-2025-28074 1 exploit
CVSS 6.1 MEDIUM 2025-05-08FIX AVAILABLE
Exploit for Cross-site Scripting in Phplist
CVE-2025-28073 1 exploit
CVSS 6.1 MEDIUM 2025-05-08FIX AVAILABLE
Exploit for Cross-site Scripting in Phplist
CVE-2017-20033
CVSS 6.1 MEDIUM 2022-06-10FIX AVAILABLE
CVE-2020-13827
CVSS 6.1 MEDIUM 2020-06-04FIX AVAILABLE
CVE-2017-20036
CVSS 5.4 MEDIUM 2022-06-10FIX AVAILABLE
CVE-2017-20035
CVSS 5.4 MEDIUM 2022-06-10FIX AVAILABLE
CVE-2017-20034
CVSS 5.4 MEDIUM 2022-06-10FIX AVAILABLE
CVE-2020-36399
CVSS 5.4 MEDIUM 2021-07-02FIX AVAILABLE
CVE-2020-36398
CVSS 5.4 MEDIUM 2021-07-02FIX AVAILABLE
CVE-2020-23217
CVSS 5.4 MEDIUM 2021-07-01FIX AVAILABLE
CVE-2020-23209
CVSS 5.4 MEDIUM 2021-07-01FIX AVAILABLE
CVE-2020-23208
CVSS 5.4 MEDIUM 2021-07-01FIX AVAILABLE
CVE-2020-23207
CVSS 5.4 MEDIUM 2021-07-01FIX AVAILABLE
CVE-2020-23194
CVSS 5.4 MEDIUM 2021-07-02FIX AVAILABLE
CVE-2020-23192
CVSS 5.4 MEDIUM 2021-07-02FIX AVAILABLE
CVE-2020-23190
CVSS 5.4 MEDIUM 2021-07-02FIX AVAILABLE
CVE-2020-15073
CVSS 5.4 MEDIUM 2020-07-08FIX AVAILABLE
CVE-2020-23214
CVSS 5.4 MEDIUM 2020-05-27
CVE-2006-1746
CVSS 5.0 MEDIUM 2006-04-12
CVE-2005-3557
CVSS 5.0 MEDIUM 2005-11-16
CVE-2020-22251
CVSS 4.9 MEDIUM 2020-05-18FIX AVAILABLE
CVE-2012-5228 1 exploit
CVSS 4.3 MEDIUM 2012-10-01FIX AVAILABLE
phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2012-4247 1 exploit
CVSS 4.3 MEDIUM 2012-08-12FIX AVAILABLE
phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2012-4246 1 exploit
CVSS 4.3 MEDIUM 2012-08-12FIX AVAILABLE
phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2012-2741 1 exploit
CVSS 4.3 MEDIUM 2012-09-06FIX AVAILABLE
phpList 2.10.17 - SQL Injection / Cross-Site Scripting
CVE-2011-1682 1 exploit
CVSS 4.3 MEDIUM 2011-04-13
phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
CVE-2006-5321
CVSS 4.3 MEDIUM 2006-10-17FIX AVAILABLE
CVE-2006-5294 1 exploit
CVSS 4.3 MEDIUM 2006-10-16FIX AVAILABLE
phpList 2.x - Public Pages MultipleCross-Site Scripting Vulnerabilities
CVE-2005-3556 3 exploits
CVSS 4.3 MEDIUM 2005-11-16FIX AVAILABLE
PHPList Mailing List Manager 2.x - '/admin/eventlog.php' Multiple Cross-Site Scripting VulnerabilitiesPHPList Mailing List Manager 2.x - '/admin/configure.php?id' Cross-Site Scripting
CVE-2017-20031
CVSS 4.0 MEDIUM 2022-06-10FIX AVAILABLE
CVE-2012-3952 3 exploits
CVSS 2.6 LOW 2012-08-12FIX AVAILABLE
phpList 2.10.18 Cross Site Scripting / SQL Injection VulnerabilityphpList 2.10.18 Cross Site Scripting / SQL Injection