Tincan's vulnerability profile centers on a small set of web-based applications, primarily PHPList and Webbler CMS, that serve niche content-management and mailing-list deployment roles. The recurring weakness classes—CSRF, code injection, path traversal, and input-validation failures—reflect the attack surface typical of web applications and script-driven platforms, and public exploit code has frequently become available for disclosed flaws. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tincan over time
Signals from CVEs in this vendor scope (17 CVEs).
17 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-0748MEDIUM Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack the authentication of administrators for requests that (1) add | Apr 13, 2011 | 6.8 | 33 | NO | YES |
CVE-2009-0422HIGH Dynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attackers to include and execute arbitr | Feb 5, 2009 | 7.5 | 30 | NO | YES |
CVE-2005-2432HIGH SQL injection vulnerability in PhpList allows remote attackers to modify SQL statements via the id argument to admin pages such as (1) members or (2) admin. | Aug 3, 2005 | 7.5 | 28 | NO | YES |
CVE-2005-3555MEDIUM Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute arbitrary SQL commands via the id | Nov 16, 2005 | 6.5 | 26 | NO | YES |
CVE-2012-5228MEDIUM Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web s | Oct 1, 2012 | 4.3 | 24 | NO | YES |
CVE-2011-1682MEDIUM Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1 | Apr 13, 2011 | 4.3 | 24 | NO | YES |
CVE-2005-3556MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a | Nov 16, 2005 | 4.3 | 22 | NO | YES |
CVE-2006-5294MEDIUM Cross-site scripting (XSS) vulnerability in index.php in phplist before 2.10.3 allows remote attackers to inject arbitrary web script or HTML via the unsubscribeemail parameter. | Oct 16, 2006 | 4.3 | 21 | NO | YES |
CVE-2008-5887MEDIUM phplist before 2.10.8 allows remote attackers to include files via unknown vectors, related to a "local file include vulnerability." | Jan 12, 2009 | 5.0 | 20 | NO | NO |
CVE-2006-5322HIGH Multiple SQL injection vulnerabilities in phplist before 2.10.3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. | Oct 17, 2006 | 7.5 | 19 | NO | NO |
Signals from CVEs in this vendor scope (17 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tincan.
Media articles that mention a CVE ID that affects a product developed by Tincan — matched by CVE ID, not by vendor name.