CVE-2025-28073 Information

Description

phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter which is improperly sanitized.

Reference

https://github.com/mLniumm/CVE-2025-28073 https://github.com/phpList/phplist3