CVE-2012-4247

Published: Aug 12, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote attackers to inject arbitrary web script or HTML via the (1) remote_user, (2) remote_database, (3) remote_userprefix, (4) remote_password, or (5) remote_prefix parameter to the import4 page; or the (6) id parameter to the bouncerule page.

Affected (23)

Products: Phplist: Phplist

Phplist

1 product

Phplist

Configuration A

23 vulnerable

Vulnerable Software	Affected Versions
Phplist Phplist	Up to 2.10.18
Phplist Phplist	Version 2.10.10
Phplist Phplist	Version 2.10.11
Phplist Phplist	Version 2.10.12
Phplist Phplist	Version 2.10.13
Phplist Phplist	Version 2.10.14
Phplist Phplist	Version 2.10.15
Phplist Phplist	Version 2.10.16
Phplist Phplist	Version 2.10.17
Phplist Phplist	Version 2.10.1
Phplist Phplist	Version 2.10.2
Phplist Phplist	Version 2.10.3
Phplist Phplist	Version 2.10.4
Phplist Phplist	Version 2.10.5
Phplist Phplist	Version 2.10.7
Phplist Phplist	Version 2.10.8
Phplist Phplist	Version 2.10.9
Phplist Phplist	Version 2.6.5
Phplist Phplist	Version 2.7.1
Phplist Phplist	Version 2.7.2
Phplist Phplist	Version 2.8.12
Phplist Phplist	Version 2.8.2
Phplist Phplist	Version 2.8.7