CVE-2020-35708: Phplist

High severity, CVSS 7.2. EPSS: 1.5% chance of exploitation in the next 30 days.

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Administrators" page.

Affected products

• Phplist Phplist: version 3.5.9 only

Published 2020-12-25. Last modified 2026-06-17.