CVE-2011-1682: Multiple cross-site request forgery (CSRF) vulnerabilities in phpList 2.10.13 and earlier allow remote atta...

Security readout for executives and security teams

CVE-2011-1682 describes CSRF weaknesses in phpList 2.10.13 and earlier. If an administrator is tricked while logged in, attacker-controlled requests could create a mailing list or insert XSS content. The record says details come only from third-party sources, so treat exact scope and fix status cautiously. Exposure is most likely limited to legacy phpList deployments running 2.10.13 or earlier, especially where admin sessions are accessible from regular browsing environments. Asset matching is weak because the CVE bundle lists affected vendor and product as n/a. Prioritize if the organization still runs legacy phpList, especially for customer communications or marketing lists. The business risk is unauthorized admin actions and possible script injection, but urgency is limited by old software scope and incomplete public evidence. Mitigation focus: Inventory phpList deployments and confirm whether any run version 2.10.13 or earlier.; Check phpList vendor guidance for the fixed version or supported upgrade path.; Restrict access to phpList administration interfaces to trusted networks or VPN users..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.