CVE-2012-4246

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter; or the (2) footer, (3) status, or (4) testtarget parameter in the send page.

🔗 References (12)

• cve@mitrehttp://www.phplist.com/?lid=579
• cve@mitrehttps://www.httpcs.com/advisories
• cve@mitrehttps://www.httpcs.com/advisory/httpcs23
• cve@mitrehttps://www.httpcs.com/advisory/httpcs24
• cve@mitrehttps://www.httpcs.com/advisory/httpcs25
• cve@mitrehttps://www.httpcs.com/advisory/httpcs26
• af854a3a-2127-422b-91ae-364da2661108http://www.phplist.com/?lid=579
• af854a3a-2127-422b-91ae-364da2661108https://www.httpcs.com/advisories
• af854a3a-2127-422b-91ae-364da2661108https://www.httpcs.com/advisory/httpcs23
• af854a3a-2127-422b-91ae-364da2661108https://www.httpcs.com/advisory/httpcs24
• af854a3a-2127-422b-91ae-364da2661108https://www.httpcs.com/advisory/httpcs25
• af854a3a-2127-422b-91ae-364da2661108https://www.httpcs.com/advisory/httpcs26