CVE-2011-0748: Multiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers...

Security readout for executives and security teams

CVE-2011-0748 affects phpList versions before 2.10.13. A malicious site could abuse a logged-in phpList administrator’s browser to add or edit administrator accounts without the admin intending it. This is mainly a risk where legacy phpList administration is still in use. Exposure is limited to environments running phpList earlier than 2.10.13, especially where administrators access the interface from browsers that can reach untrusted content. Treat this as a legacy-platform cleanup item with real privilege risk. Prioritize remediation if phpList administration is internet-accessible, still used for business communications, or managed by shared administrator accounts. Mitigation focus: Upgrade phpList to 2.10.13 or later if any earlier version remains deployed.; Check current phpList vendor guidance for supported upgrade and hardening instructions.; Restrict access to the phpList administrator interface to trusted networks or VPN users..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.