← Database

CVE-2025-28073

MEDIUM CVSS: 6.1 Published: 2025-05-08 Modified: 2026-06-17

Description

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.

Affected Platforms

Phplist Phplist

Weakness Type

CWE-79

References