https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 11:04:44 +0000 https://cve.radiocsirt.org/vuln/cve-2023-27576 <p>An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system&#39;s super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with updatepassword=1, a modified request (manipulating both the ID parameter and the associated username) can bypass the intended email confirmation requirement. For example, the attacker can start from an updatepassword=1 request with their own ID number, and change the ID number to 1 (representing the super admin account) and change the username to admin2. In the first step, the attacker changes the super admin&#39;s email address to one under the attacker&#39;s control. In the second step, the attacker performs a password reset for the super admin account. The new password allows login as the super admin, i.e., a successful account takeover.</p> <p>An issue was discovered in phpList before 3.6.14. Due to an access error, it was possible to manipulate and edit data of the system&#39;s super admin, allowing one to perform an account takeover of the user with super-admin permission. Specifically, for a request with updatepassword=1, a modified request (manipulating both the ID parameter and the associated username) can bypass the intended email confirmation requirement. For example, the attacker can start from an updatepassword=1 request with their own ID number, and change the ID number to 1 (representing the super admin account) and change the username to admin2. In the first step, the attacker changes the super admin&#39;s email address to one under the attacker&#39;s control. In the second step, the attacker performs a password reset for the super admin account. The new password allows login as the super admin, i.e., a successful account takeover.</p> https://cve.radiocsirt.org/vuln/cve-2023-27576