CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15072
https://notcve.org/view.php?id=CVE-2020-15072
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section. Se detectó un problema en phpList versiones hasta 3.5.4. Una vulnerabilidad de Inyección SQL basada en errores por medio de la sección Import Administrators • https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377 https://www.phplist.org/newslist/phplist-3-5-5-release-notes • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-15073
https://notcve.org/view.php?id=CVE-2020-15073
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section. Se detectó un problema en phpList versiones hasta 3.5.4. Se produce una vulnerabilidad de tipo XSS en la sección Import Administrators mediante la carga de un documento de texto editado. • https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377 https://www.phplist.org/newslist/phplist-3-5-5-release-notes • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •