CVE Intelligence

Phplist phpList vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Phplist phpList: 1 record(s), with affected versions and fixes.

CVE-2026-92806 High · 8.1 CWE-352 Sep 16, 2026
phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.