CVE-2011-0748

CVE-2011-0748 describes multiple Cross-Site Request Forgery (CSRF) vulnerabilities in phpList versions prior to 2.10.13, specifically impacting the tincan phplist product. These flaws allow remote attackers to hijack administrator authentication to add or edit administrator accounts. With a CVSS score of 6.8, this vulnerability is of medium severity, requiring medium attack complexity but potentially leading to partial confidentiality, integrity, and availability compromise. While not listed in CISA's KEV catalog, public exploit code exists on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.