phpList
- Total products in the ecosystem
- 2
- Total vulnerabilities (90 days)
- 3
en
Verify to analyze this security profile
As of 10/06/2026, phpList recorded 3 security vulnerabilities in the last 90 days across 2 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, phplist3 had the most security vulnerabilities in the phpList ecosystem, with 2 vulnerabilities—approximately 66.67% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-92806phpList before 3.6.17 Cross-Site Request Forgery via massremove.php | Exploitation statusPublic exploit | FixYes | Affected productphpList | Published09/16/2026 | SeverityHigh |
CVE-2026-73482phpList < 3.7.0-RC5 Cross-Site Request Forgery via admins.php | Exploitation statusPublic exploit | FixYes | Affected productphplist3 | Published08/13/2026 | SeverityHigh |
CVE-2026-73481phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules | Exploitation statusPublic exploit | FixYes | Affected productphplist3 | Published08/13/2026 | SeverityMedium |
CVE-2025-28074 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/08/2025 | SeverityMedium |
CVE-2025-28073 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/08/2025 | SeverityMedium |
CVE-2023-27576 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published08/18/2023 | SeverityUnknown |
CVE-2017-20036PHPList Bounce Rule Persistent cross site scriting | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityLow |
CVE-2017-20035PHPList Subscribe Persistent cross site scriting | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityLow |
CVE-2017-20034PHPList List Name Persistent cross site scriting | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityLow |
CVE-2017-20033PHPList Reflected cross site scriting | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityMedium |
CVE-2017-20032PHPList Subscription sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityMedium |
CVE-2017-20031PHPList information disclosure | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityLow |
CVE-2017-20030PHPList Sending Campain sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityMedium |
CVE-2017-20029PHPList Edit Subscription index.php sql injection | Exploitation statusPublic exploit | FixNot confirmed | Affected productPHPList | Published06/10/2022 | SeverityHigh |
CVE-2020-22249 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/06/2021 | SeverityUnknown |
CVE-2020-22251 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/06/2021 | SeverityUnknown |
CVE-2020-36399 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2020-36398 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2020-23194 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2020-23192 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2020-23190 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/02/2021 | SeverityUnknown |
CVE-2020-23217 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2021 | SeverityUnknown |
CVE-2020-23214 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2021 | SeverityUnknown |
CVE-2020-23209 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2021 | SeverityUnknown |
CVE-2020-23208 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2021 | SeverityUnknown |
CVE-2020-23207 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/01/2021 | SeverityUnknown |
CVE-2020-23361 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/27/2021 | SeverityUnknown |
CVE-2021-3188 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/21/2021 | SeverityUnknown |
CVE-2020-35708 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/25/2020 | SeverityUnknown |
CVE-2020-15072 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/08/2020 | SeverityUnknown |
CVE-2020-15073 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/08/2020 | SeverityUnknown |
CVE-2020-13827 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/04/2020 | SeverityUnknown |
CVE-2020-12639 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/04/2020 | SeverityUnknown |
CVE-2020-8547 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/03/2020 | SeverityUnknown |
CVE-2014-2916 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/05/2014 | SeverityUnknown |
CVE-2012-2740 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/06/2012 | SeverityUnknown |
CVE-2012-2741 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/06/2012 | SeverityUnknown |
CVE-2012-3953 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/12/2012 | SeverityUnknown |
CVE-2012-4246 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/12/2012 | SeverityUnknown |
CVE-2012-4247 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/12/2012 | SeverityUnknown |
CVE-2012-3952 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/12/2012 | SeverityUnknown |
CVE-2008-6178 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published02/19/2009 | SeverityUnknown |
CVE-2004-2744 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/09/2007 | SeverityUnknown |
CVE-2006-5524 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/26/2006 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan