CVE-2023-27576

Summary

CVE-2023-27576: A vulnerability was discovered in phpList before 3.6.14 that enabled unauthorized access to the system's super admin account. By manipulating the ID parameter and associated username in a password reset request, an attacker could bypass the email confirmation requirement and change the super admin's email address and password, allowing them to log in as the super admin and gain full control of the phpList installation. This vulnerability could lead to account takeover and potentially serious data breaches.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.