medium6.1
CVE-2025-28073
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.
Impact
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Phplist | Phplist | before 3.6.15 |