Description
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by High-Tech Bridge SA · textwebappsphp
https://www.exploit-db.com/exploits/37590
References (7)
Core 7
Core References
Various Sources x_refsource_confirm
http://www.phplist.com/?lid=579
Vendor Advisory x_refsource_misc
https://www.htbridge.com/advisory/HTB23100
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/77526
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/54887
Exploit mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/50150
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/84482
Scores
EPSS
0.0972
EPSS Percentile
93.0%
Details
CWE
CWE-79
Status
published
Products (23)
phplist/phplist
2.6.5
phplist/phplist
2.7.1
phplist/phplist
2.7.2
phplist/phplist
2.8.2
phplist/phplist
2.8.7
phplist/phplist
2.8.12
phplist/phplist
2.10.1
phplist/phplist
2.10.2
phplist/phplist
2.10.3
phplist/phplist
2.10.4
... and 13 more
Published
Aug 12, 2012
Tracked Since
Feb 18, 2026