medium6.5
CVE-2025-46011
Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.
Impact
Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nadh | Listmonk | from 2.4.0 before 5.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/kevinroleke/security/tree/main/CVE-2025-46011
- https://github.com/knadh/listmonk/commit/4b805f885b9f5a20126ec06f8b59dc448c4af33b
- https://github.com/knadh/listmonk/issues/2412
- https://github.com/knadh/listmonk/releases/tag/v4.1.0
- https://github.com/knadh/listmonk/releases/tag/v5.0.0