VIR Vulnerability Intelligence Relay

CVE-2012-5228

medium
Published 2012-10-01 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
5.3

Description

Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions before 2.10.19 allows remote attackers to inject arbitrary web script or HTML via the testtarget parameter. NOTE: some of these details are obtained from third party information.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-18419 webapps php verified
Cyber-Crystal · 2012-01-26

phpList 2.10.9 - Cross-Site Request Forgery / Cross-Site Scripting

Source code queued for fetch — refresh in a moment.

Application impact
VendorProductVersionsFixed
tincanphplist2.10.3
tincanphplist2.10.4
tincanphplist{"endIncluding":"2.10.18"}
tincanphplist1.0
tincanphplist1.0.1
tincanphplist1.1.2b
tincanphplist1.1.3b
tincanphplist1.1.4b
tincanphplist1.1.5
tincanphplist1.1.5b
tincanphplist1.1.6
tincanphplist1.1.7
tincanphplist1.3.5
tincanphplist1.3.7
tincanphplist1.4.1
tincanphplist1.5.0
tincanphplist1.5.1
tincanphplist1.6.0
tincanphplist1.6.1
tincanphplist1.6.3
tincanphplist1.6.4
tincanphplist1.7.0
tincanphplist1.7.1
tincanphplist1.8.0
tincanphplist1.9.0
tincanphplist1.9.1
tincanphplist1.9.2
tincanphplist1.9.3
tincanphplist2.1.0
tincanphplist2.1.1
tincanphplist2.1.3
tincanphplist2.1.4
tincanphplist2.2.0
tincanphplist2.2.1
tincanphplist2.3.0
tincanphplist2.3.1
tincanphplist2.3.2
tincanphplist2.3.3
tincanphplist2.3.4
tincanphplist2.4.0
tincanphplist2.4.7
tincanphplist2.5.0
tincanphplist2.5.1
tincanphplist2.5.2
tincanphplist2.5.3
tincanphplist2.5.4
tincanphplist2.5.5
tincanphplist2.5.6
tincanphplist2.5.7
tincanphplist2.5.8
tincanphplist2.6
tincanphplist2.6.0
tincanphplist2.6.1
tincanphplist2.6.2
tincanphplist2.6.3
tincanphplist2.6.4
tincanphplist2.6.5
tincanphplist2.7.1
tincanphplist2.7.2
tincanphplist2.8.2
tincanphplist2.8.7
tincanphplist2.8.12
tincanphplist2.9.3
tincanphplist2.9.4
tincanphplist2.9.5
tincanphplist2.10.1
tincanphplist2.10.2
tincanphplist2.10.5
tincanphplist2.10.6
tincanphplist2.10.7
tincanphplist2.10.8
tincanphplist2.10.9
tincanphplist2.10.10
tincanphplist2.10.11
tincanphplist2.10.12
tincanphplist2.10.13
tincanphplist2.10.14
tincanphplist2.10.15
tincanphplist2.10.16
tincanphplist2.10.17
tincanphplist2.10.19

References

CWEs

CWE-79

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.