CVE-2012-3952

Phplist < 2.10.18 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.

Exploits (1)

exploitdb WORKING POC VERIFIED

by High-Tech Bridge SA · textwebappsphp

https://www.exploit-db.com/exploits/37590

View Code ZIP pw:eip

References (7)

[Exploit] http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html

[Vendor Advisory] http://secunia.com/advisories/50150

[Various Sources] http://www.phplist.com/?lid=579

[Exploit] http://www.securityfocus.com/bid/54887

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/77526

[Vendor Advisory] https://www.htbridge.com/advisory/HTB23100

[Third Party Advisory, VDB Entry] http://osvdb.org/84482

Scores

EPSS 0.0661

EPSS Percentile 91.1%

Classification

CWE

CWE-79

Status published

Affected Products (24)

phplist/phplist < 2.10.18

phplist/phplist

... and 9 more

Timeline

Published Aug 12, 2012

Tracked Since Feb 18, 2026