CVE-2025-28073

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-280746.1phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php. The vulnerability is exploit CVE-2025-280766.5Multiple SQL injection vulnerabilities in EasyVirt DCScope <= 8.6.4 and CO2Scope <= 1.3.4 allows remote authenticated attackers to execute a CVE-2025-28085.4The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Phone Num CVE-2025-280879.8Sourcecodester Online Exam System 1.0 is vulnerable to SQL Injection via dash.php.CVE-2025-280899.1maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.CVE-2025-28097.3The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includi CVE-2025-280909.1maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.CVE-2025-280919.1maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.CVE-2025-280926.3ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.CVE-2025-280936.3ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.CVE-2025-280946.5shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.CVE-2025-280965.4OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.