phplist phplist

Name: phplist phplist
Brand: phplist

productUS

cpe:2.3:a:phplist:phplist:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

6critical6high24medium2low

updated 2026-10-28

vulnerabilities (40)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2008-6178US	high7.5	7.81% (95th)	Exploit	no fix	2009-02-19	6 versions
CVE-2020-8547US	critical9.8	5.86% (93rd)	Exploit	no fix	2020-02-03	= 3.5.0
CVE-2012-2740US	high7.5	3.33% (89th)	Exploit	no fix	2012-09-06	16 versions
CVE-2012-2741US	medium4.3	2.86% (87th)	Exploit	no fix	2012-09-06	16 versions
CVE-2006-5524US	medium6.8	2.09% (82nd)	Exploit	no fix	2006-10-26	= 2.10.2
CVE-2012-4247US	medium4.3	2.06% (81st)	Exploit	no fix	2012-08-12	23 versions
CVE-2012-3952US	low2.6	1.93% (80th)	Exploit	no fix	2012-08-12	23 versions
CVE-2012-4246US	medium4.3	1.86% (79th)	Exploit	no fix	2012-08-12	23 versions
CVE-2012-3953US	high7.5	1.12% (66th)	Exploit	no fix	2012-08-12	23 versions
CVE-2025-28074US	—	0.64% (50th)	Exploit	3.6.15	2025-05-08	< 3.6.15
CVE-2025-28073US	—	0.64% (50th)	Exploit	3.6.15	2025-05-08	< 3.6.15
CVE-2017-20029US	critical9.8	21.0% (98th)	—	no fix	2022-06-10	= 3.2.6
CVE-2020-22249US	critical9.8	2.89% (87th)	—	no fix	2021-07-06	= 3.5.1
CVE-2021-3188US	critical9.8	1.81% (79th)	—	no fix	2021-01-26	= 3.6.0
CVE-2020-35708US	high7.2	1.50% (74th)	—	no fix	2020-12-25	= 3.5.9
CVE-2020-23361US	critical9.8	1.22% (69th)	—	no fix	2021-01-27	= 3.5.3
CVE-2020-15072US	high8.8	1.20% (68th)	—	no fix	2020-07-08	≤ 3.5.4
CVE-2014-2916US	medium6.8	1.08% (65th)	—	no fix	2014-05-05	6 versions
CVE-2017-20032US	critical9.8	0.96% (61st)	—	no fix	2022-06-10	= 3.2.6
CVE-2017-20031US	low2.7	0.91% (60th)	—	no fix	2022-06-10	= 3.2.6
CVE-2020-13827US	medium6.1	0.87% (59th)	—	3.5.4	2020-06-04	< 3.5.4
CVE-2017-20030US	high7.2	0.87% (59th)	—	no fix	2022-06-10	= 3.2.6
CVE-2020-15073US	medium5.4	0.75% (55th)	—	no fix	2020-07-08	≤ 3.5.4
CVE-2017-20033US	medium6.1	0.75% (55th)	—	no fix	2022-06-10	= 3.2.6
CVE-2020-12639US	medium6.1	0.70% (53rd)	—	3.5.3	2020-05-04	< 3.5.3
CVE-2020-22251US	medium4.8	0.62% (50th)	—	no fix	2021-07-06	≤ 3.5.3
CVE-2017-20036US	medium5.4	0.60% (48th)	—	no fix	2022-06-10	= 3.2.6
CVE-2017-20035US	medium5.4	0.60% (48th)	—	no fix	2022-06-10	= 3.2.6
CVE-2017-20034US	medium5.4	0.60% (48th)	—	no fix	2022-06-10	= 3.2.6
CVE-2020-23217US	medium5.4	0.56% (46th)	—	no fix	2021-07-01	= 3.5.3
CVE-2020-23214US	medium5.4	0.55% (46th)	—	no fix	2021-07-01	= 3.5.3
CVE-2020-23208US	medium5.4	0.55% (46th)	—	no fix	2021-07-01	= 3.5.3
CVE-2020-23207US	medium5.4	0.54% (45th)	—	no fix	2021-07-01	= 3.5.3
CVE-2020-23192US	medium5.4	0.53% (45th)	—	no fix	2021-07-02	≤ 3.5.4
CVE-2020-36398US	medium5.4	0.52% (44th)	—	no fix	2021-07-02	≤ 3.5.4
CVE-2020-23209US	medium5.4	0.52% (44th)	—	no fix	2021-07-01	= 3.5.3
CVE-2020-23194US	medium5.4	0.51% (43rd)	—	no fix	2021-07-02	≤ 3.5.4
CVE-2020-23190US	medium5.4	0.51% (43rd)	—	no fix	2021-07-02	= 3.5.4
CVE-2020-36399US	medium5.4	0.51% (43rd)	—	no fix	2021-07-02	≤ 3.5.4
CVE-2023-27576US	medium6.7	0.34% (28th)	—	no fix	2023-08-18	= 3.6.12

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')25 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')7 CVEs
CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)4 CVEs
CWE-1236Improper Neutralization of Formula Elements in a CSV File1 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor1 CVEs
CWE-352Cross-Site Request Forgery (CSRF)1 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type1 CVEs
CWE-639Authorization Bypass Through User-Controlled Key1 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE40 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan