[CVE-2026-92806] phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscr…

Descripción técnica

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.

Puntuación CVSS

Score: 8.1/10 — Severidad: HIGH — Estado NIST: Received

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Debilidades (CWE)

CWE-352

Fuente oficial

Publicado en NIST NVD.