CVE-2025-28074

6.1 mediumEPSS 0.6%

Medium (6.1) in phplist phplist. EPSS 0.6% chance of exploitation in the next 30 days.

phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious JavaScript.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-05-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

phplist:phplist

References

https://github.com/mLniumm/CVE-2025-28074
https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.php
https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15
https://www.phplist.org/newslist/phplist-3-6-15-release-notes/

Check your stack JSON