Vulnerability Description
phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious JavaScript.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phplist | Phplist | < 3.6.15 |
Related Weaknesses (CWE)
References
- https://github.com/mLniumm/CVE-2025-28074Third Party Advisory
- https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.phpProduct
- https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15Product
- https://www.phplist.org/newslist/phplist-3-6-15-release-notes/Release Notes
FAQ
What is CVE-2025-28074?
CVE-2025-28074 is a vulnerability with a CVSS score of 6.1 (MEDIUM). phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal pa...
How severe is CVE-2025-28074?
CVE-2025-28074 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-28074?
Check the references section above for vendor advisories and patch information. Affected products include: Phplist Phplist.