CVE-2026-92806 — phpList before 3.6.17 Cross-Site Request Forgery via massremove.php
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to v…
Published: 2026-09-16 · CVSS: 7.2 · CVSS 4.0
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7