Stored Cross Site Scripting Vulnerability in phpList by phpList Ltd.
CVE-2020-23190

5.4MEDIUM

Key Information:

Vendor

PHPlist

Status
PHPlist
Vendor
CVE Published:
2 July 2021

What is CVE-2020-23190?

A critical vulnerability exists in the 'Import emails' module of phpList version 3.5.4, allowing authenticated attackers to inject and execute arbitrary web scripts or HTML. This stored XSS flaw enables attackers to manipulate the application, potentially compromising user data and application integrity.

References

https://github.com/phpList/phplist3/issues/667
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.