PatchTheCVEphplist vulnerabilities
Recent CVEs affecting phplist products. 2 tracked.
phplist has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-05-08. Highest priority: CVE-2025-28074 (score 34/100).
- CVE-2025-28074 MEDIUM 6.1 UPGRADE phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php
- CVE-2025-28073 MEDIUM 6.1 UPGRADE phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint
FAQ
How do I fix phplist vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is phplist being exploited right now?
None of the tracked phplist CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which phplist CVE should I patch first?
CVE-2025-28074 currently ranks highest (34/100): phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.