VulnerabilityAnalyzed

CVE-2025-28074

phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.

MEDIUM 6.1EPSS 0.61%

Does this matter?

Lower severity and a low EPSS score (0.61%). Track it; it rarely justifies an emergency change on its own.

Description

phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious JavaScript.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.61% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: phplist/phplist
Source: cve@mitre.org

References

https://github.com/mLniumm/CVE-2025-28074Third Party Advisory
https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.phpProduct
https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15Product
https://www.phplist.org/newslist/phplist-3-6-15-release-notes/Release Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.