CVE-2020-23361: Phplist

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

Affected products

• Phplist Phplist: version 3.5.3 only

Published 2021-01-27. Last modified 2026-06-17.