Phplist is a focused open-source mailing list and email marketing platform that, despite a narrow product footprint, operates in environments where it handles user submissions, authentication, and direct web interaction. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a frequent tendency toward public exploit availability, reflecting the exposure model of a web-facing application processing untrusted input. The recurring weakness classes center on web-application input handling: cross-site scripting, SQL injection, and authorization-bypass flaws recur across the platform's core mailing-list and user-management surfaces. Defenders running Phplist should prioritize patching security advisories promptly and isolate instances from direct internet exposure where feasible. Current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Phplist over time
Signals from CVEs in this vendor scope (41 CVEs).
41 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-8547CRITICAL phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively | Feb 3, 2020 | 9.8 | 46 | NO | YES |
CVE-2017-20029CRITICAL A vulnerability was found in PHPList 3.2.6 and classified as critical. This issue affects some unknown processing of the file /lists/index.php of the component Edit Subscription. T | Jun 10, 2022 | 9.8 | 43 | NO | NO |
CVE-2012-3953HIGH SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitrary SQL commands via the delete parameter to the editattribut | Aug 12, 2012 | 7.5 | 33 | NO | YES |
CVE-2008-6178HIGH Unrestricted file upload vulnerability in editor/filemanager/browser/default/connectors/php/connector.php in FCKeditor 2.2, as used in Falt4 CMS, Nuke ET, and other products, allow | Feb 19, 2009 | 7.5 | 33 | NO | YES |
CVE-2012-2740HIGH SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbitrary SQL commands via the sortby parameter in a find action | Sep 6, 2012 | 7.5 | 32 | NO | YES |
CVE-2017-20032CRITICAL A vulnerability was found in PHPList 3.2.6. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subscription. The manipulation lead | Jun 10, 2022 | 9.8 | 31 | NO | NO |
CVE-2020-22249CRITICAL Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a malicious plugin which contains | Jul 6, 2021 | 9.8 | 30 | NO | NO |
CVE-2021-3188CRITICAL phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. | Jan 26, 2021 | 9.8 | 30 | NO | NO |
CVE-2020-15072HIGH An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section. | Jul 8, 2020 | 8.8 | 28 | NO | NO |
CVE-2006-5524MEDIUM Cross-site scripting (XSS) vulnerability in index.php in phplist 2.10.2 allows remote attackers to inject arbitrary web script or HTML via the p parameter. NOTE: This issue might | Oct 26, 2006 | 6.8 | 27 | NO | YES |
Signals from CVEs in this vendor scope (41 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Phplist.
Media articles that mention a CVE ID that affects a product developed by Phplist — matched by CVE ID, not by vendor name.