CVE-2025-28074mediumCWE-79

CVE-2025-28074

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.1epss 0.6%

probabilidad de explotación

0.6%top 53% de las CVE

explotación observada

noninguna fuente lo reporta

phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing an attacker to inject malicious JavaScript.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Productos afectados

n/a · n/a

Referencias

https://github.com/mLniumm/CVE-2025-28074 https://github.com/phpList/phplist3/blob/main/public_html/lists/lt.php https://github.com/phpList/phplist3/compare/v3.6.14...v3.6.15 https://www.phplist.org/newslist/phplist-3-6-15-release-notes/