CVE-2014-2916
phplist < 3.0.6 - Cross-Site Request Forgery in Subscription Page Editor
Title source: llmDescription
Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allows remote attackers to hijack the authentication of administrators via a request to admin/.
References (4)
Core 4
Core References
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/57893
Exploit x_refsource_misc
http://labs.davidsopas.com/2014/04/phplist-csrf-on-subscription-page.html
Patch x_refsource_confirm
http://www.phplist.com/?lid=638
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1030191
Scores
EPSS
0.0108
EPSS Percentile
61.1%
Details
CWE
CWE-352
Status
published
Products (6)
phplist/phplist
3.0.0
phplist/phplist
3.0.1
phplist/phplist
3.0.2
phplist/phplist
3.0.3
phplist/phplist
3.0.4
phplist/phplist
< 3.0.5
Published
May 05, 2014
Tracked Since
Feb 18, 2026