CVE-2020-8547: Phplist

Critical severity, CVSS 9.8. EPSS: 5.9% chance of exploitation in the next 30 days.

phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

Affected products

• Phplist Phplist: version 3.5.0 only

Published 2020-02-03. Last modified 2026-06-17.