CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 1CVE-2017-20031 – PHPList information disclosure
https://notcve.org/view.php?id=CVE-2017-20031
A vulnerability was found in PHPList 3.2.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument sortby with the input password leads to information disclosure. The attack can be launched remotely. • http://seclists.org/fulldisclosure/2017/Mar/45 https://vuldb.com/?id.98917 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2017-20030 – PHPList Sending Campain sql injection
https://notcve.org/view.php?id=CVE-2017-20030
A vulnerability was found in PHPList 3.2.6. It has been classified as critical. Affected is an unknown function of the file /lists/admin/ of the component Sending Campain. The manipulation leads to sql injection. It is possible to launch the attack remotely. • http://seclists.org/fulldisclosure/2017/Mar/45 https://vuldb.com/?id.98916 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-20029 – PHPList Edit Subscription index.php sql injection
https://notcve.org/view.php?id=CVE-2017-20029
A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • http://seclists.org/fulldisclosure/2017/Mar/45 https://vuldb.com/?id.98915 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-22251
https://notcve.org/view.php?id=CVE-2020-22251
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en phpList versión 3.5.3, por medio del campo login name en Manage Administrators al añadir un nuevo administrador • https://github.com/phpList/phplist3/issues/660 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36399
https://notcve.org/view.php?id=CVE-2020-36399
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "rule1" parameter under the "Bounce Rules" module. Una vulnerabilidad de tipo cross site scripting (XSS) almacenada en phplist versiones 3.5.4 y por debajo permite a atacantes ejecutar scripts web o HTML arbitrario por medio de una carga útil diseñada en el parámetro "rule1" bajo el módulo "Bounce Rules" • https://github.com/phpList/phplist3/issues/675 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •