GCVE - cpe:2.3:a:phplist:phplist:3.5.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:phplist:phplist:3.5.3:*:*:*:*:*:*:*

part: a version: 3.5.3 update: *

Vendor	Phplist (`c06ea4cf-421e-57d6-97f6-16bef961c27a`)
Product	Phplist (`dccc7946-c80c-5ab0-9d5e-4bdece2d2b9b`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/phplist/core`	purl2cpe	2026-06-01 10:11:23.437713
`pkg:sourceforge/phplist`	purl2cpe	2026-06-01 10:11:23.437715

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-23361`	vulnerable	2026-06-08 05:22:31.899686	Details available phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. Published: 2021-01-27T15:30:07.000Z Updated: 2024-08-04T14:58:15.179Z Open on db.gcve.eu Reference links https://github.com/phpList/phplist3/issues/668	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23217`	vulnerable	2026-06-08 05:22:31.816898	Details available A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Add a list" field under the "Import Emails" module. Published: 2021-07-01T20:13:55.000Z Updated: 2024-08-04T14:58:14.758Z Open on db.gcve.eu Reference links https://www.phplist.org/newslist/phplist-3-5-4-release-notes/ https://github.com/phpList/phplist3/issues/672	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23214`	vulnerable	2026-06-08 05:22:31.816505	Details available A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Configure categories" field under the "Categorise Lists" module. Published: 2021-07-01T20:12:51.000Z Updated: 2024-08-04T14:58:14.749Z Open on db.gcve.eu Reference links https://github.com/phpList/phplist3/issues/669	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23209`	vulnerable	2026-06-08 05:22:31.816118	Details available A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "List Description" field under the "Edit A List" module. Published: 2021-07-01T20:12:03.000Z Updated: 2024-08-04T14:58:14.552Z Open on db.gcve.eu Reference links https://github.com/phpList/phplist3/issues/666	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23208`	vulnerable	2026-06-08 05:22:31.815808	Details available A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Send test" field under the "Start or continue campaign" module. Published: 2021-07-01T20:10:45.000Z Updated: 2024-08-04T14:58:14.742Z Open on db.gcve.eu Reference links https://github.com/phpList/phplist3/issues/665	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-23207`	vulnerable	2026-06-08 05:22:31.815279	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.