Threats tagged 'ghsa-q6pp-9mv4-x9xp'

phpList versions prior to 3.6.17 contain a vulnerability where the mass subscriber removal form handler does not properly validate cross-site request forgery (CSRF) tokens. This flaw allows attackers to trick logged-in administrators into visiting malicious pages that can silently delete and blacklist subscriber addresses without proper authentication checks.