VULNERABILITY INTELLIGENCE

CVE-2025-28073

CVSS score6.1 MEDIUM

EPSS probability0.64%

CISA KEVNot currently listed

Published2025-05-08

Last modified2026-06-17

Description

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.