CVE-2025-28073

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cve@mitre.org

Published

2025-05-08

Last modified

2025-06-07

Weaknesses

CWE-79

Affected products

• Phplist (Phplist)

References

• https://github.com/mLniumm/CVE-2025-28073
• https://github.com/phpList/phplist3
• https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15
• https://www.phplist.org/newslist/phplist-3-6-15-release-notes/