PT-2025-20424 · Phplist · Phplist

Published 2025-05-08 · Updated 2025-06-16 · CVE-2025-28074

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions phpList versions prior to 3.6.3

Description The issue is related to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. This allows an attacker to inject malicious JavaScript when the application dynamically references internal paths and processes untrusted input without escaping.

Recommendations For versions prior to 3.6.3, update to version 3.6.3 or later to resolve the issue. As a temporary workaround, consider disabling the dynamic referencing of internal paths in lt.php until a patch is available. Restrict access to untrusted input to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-28074

Affected Products

Phplist

References · 12

• 🔥 https://github.com/mLniumm/CVE-2025-28074 · Exploit
• https://osv.dev/vulnerability/CVE-2025-28074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-28074 · Security Note
• https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.php · Note
• https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15 · Note
• https://twitter.com/dailycve/status/1934725164136034749 · Twitter Post
• https://t.me/cvedetector/24857 · Telegram Post
• https://t.me/cvetracker/23402 · Telegram Post
• https://twitter.com/CVEnew/status/1920595171990999158 · Twitter Post
• https://t.me/cvenotify/125838 · Telegram Post
• https://t.me/cvenotify/124997 · Telegram Post
• https://phplist.org/newslist/phplist-3-6-15-release-notes · Note