phpList vulnerabilities

CVEs whose affected-version data names the phpList package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-92806High· 8.1PoC

5d ago

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitr…

▾ MidnightphpList · phpListEPSS 0.17%via NVD