Threats affecting pkg:github/phplist/phplist3

phpList versions prior to 3.6.17 contain a vulnerability where the mass subscriber removal form handler does not properly validate cross-site request forgery (CSRF) tokens. This flaw allows attackers to trick logged-in administrators into visiting malicious pages that can silently delete and blacklist subscriber addresses without proper authentication checks.