CVEvulnerability
CVE-2020-15073
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-07-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
Affected configurations
• phplist phplist (<= 3.5.4)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html Exploit, Third Party Advisory
- https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377 Release Notes, Vendor Advisory
- https://www.phplist.org/newslist/phplist-3-5-5-release-notes/ Release Notes, Vendor Advisory
- https://blog.telspace.co.za/2020/07/phplist-cve-2020-15072-cve-2020-15073.html Exploit, Third Party Advisory
- https://discuss.phplist.org/t/phplist-3-5-5-has-been-released/6377 Release Notes, Vendor Advisory
- https://www.phplist.org/newslist/phplist-3-5-5-release-notes/ Release Notes, Vendor Advisory