CVSS: 2.6EPSS: 4%CPEs: 23EXPL: 3CVE-2012-3952 – phpList 2.10.18 - 'unconfirmed' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-3952
Cross-site scripting (XSS) vulnerability in admin/index.php in phpList before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the unconfirmed parameter to the user page. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en admin/index.php en phpList anterior a v2.10.19 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro unconfirmed para la página user. phpList version 2.10.18 suffers from cross site scripting and remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/37590 http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html http://osvdb.org/84482 http://secunia.com/advisories/50150 http://www.phplist.com/?lid=579 http://www.securityfocus.com/bid/54887 https://exchange.xforce.ibmcloud.com/vulnerabilities/77526 https://www.htbridge.com/advisory/HTB23100 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 23EXPL: 4CVE-2012-3953 – phpList 2.10.18 - 'index.php' SQL Injection
https://notcve.org/view.php?id=CVE-2012-3953
SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattributes page. Vulnerabilidad de inyección SQL en admin/index.php en phpList anterior a v2.10.19, permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro delete para la página editattributes. phpList version 2.10.18 suffers from cross site scripting and remote SQL injection vulnerabilities. • https://www.exploit-db.com/exploits/37613 http://archives.neohapsis.com/archives/bugtraq/2012-08/0059.html http://osvdb.org/84483 http://www.phplist.com/?lid=579 https://exchange.xforce.ibmcloud.com/vulnerabilities/77527 https://www.htbridge.com/advisory/HTB23100 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 75EXPL: 1CVE-2011-1682 – phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-1682
Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create a list or (2) insert cross-site scripting (XSS) sequences. NOTE: this issue exists because of an incomplete fix for CVE-2011-0748. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en phpList v2.10.13 y anteriores permiten a atacantes remotos secuestras la autenticación de los adminitradores para peticiones que (1) creen una lista o (2) inserten secuencias de comandos en sitios cruzados (XSS). NOTA: esta vulnerabilidad existe por una solución incompleta de CVE-2011-0748. • https://www.exploit-db.com/exploits/18419 http://secunia.com/advisories/44041 https://exchange.xforce.ibmcloud.com/vulnerabilities/66666 https://exchange.xforce.ibmcloud.com/vulnerabilities/66816 • CWE-352: Cross-Site Request Forgery (CSRF) •