Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
phpList Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2026-92806 - Vulnerability Database
phpList

phpList Cross-Site Request Forgery (CSRF) Vulnerability - CVE-2026-92806

Low
Reference: CVE-2026-92806
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-92806
Title: phpList Cross-Site Request Forgery (CSRF) Vulnerability
Overview:

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can induce logged-in administrators to visit crafted pages that silently delete and blacklist arbitrary subscriber addresses without authentication verification.