CVE-2026-92806 in phpList
要約
〜によって MITRE • 2026年09月17日
phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.
If you want to get best quality of vulnerability data, you may have to visit VulDB.