PT-2025-23854 · Listmonk · Listmonk

Knadh · Published 2025-06-04 · Updated 2025-10-15 · CVE-2025-46011

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Listmonk versions 2.4.0 through 4.1.0

Description The issue allows attackers to escalate privileges through SQL Injection in the QuerySubscribers function.

Recommendations For versions 2.4.0 through 4.1.0, consider disabling the QuerySubscribers function until a patch is available to prevent privilege escalation.

Exploit

Fix

LPE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-46011

Affected Products

Listmonk

References · 10

• 🔥 https://github.com/kevinroleke/security/tree/main/CVE-2025-46011 · Exploit
• https://github.com/knadh/listmonk/commit/4b805f885b9f5a20126ec06f8b59dc448c4af33b · Patch
• https://osv.dev/vulnerability/CVE-2025-46011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46011 · Security Note
• https://github.com/knadh/listmonk/releases/tag/v4.1.0 · Note
• https://github.com/knadh/listmonk/issues/2412 · Note
• https://github.com/knadh/listmonk/releases/tag/v5.0.0 · Note
• https://twitter.com/CVEnew/status/1930357591533625844 · Twitter Post
• https://t.me/cveNotify/138851 · Telegram Post
• https://t.me/cvetracker/25435 · Telegram Post