CVE-2005-4142: Lyris Technologies Inc Listmanager

High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days.

The web interface for subscribing new users in Lyris ListManager 5.0 through 8.8b, in combination with a line wrap feature, allows remote attackers to execute arbitrary list administration commands via LFCR (%0A%0D) sequences in the pw parameter. NOTE: it is not clear whether this is a variant of a CRLF injection vulnerability.

Affected products

• Lyris Technologies Inc Listmanager: version 5.0 only; version 6.0 only; version 7.0 only; version 8.0 only; version 8.8a only

Published 2005-12-10. Last modified 2026-06-16.