CyberSecBulletin

phpList vulnerabilities

We track 2 vulnerabilities in phpList products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.

2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score

Latest phpList vulnerabilities

  • 8.1 High severity

    phpList: Cross-Site Request Forgery

    CVE-2026-92806phpList

    phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresse

  • 8.1 High severity

    phplist3: Cross-Site Request Forgery

    CVE-2026-73482phpList

    phpList before 3.7.0-RC5 contains a cross-site request forgery (CSRF) vulnerability in lists/admin/admins.php. The administrator deletion action is triggered via an unauthenticated GET request (?page=admins&delete=N) that is not protected by a CSRF token (the