CVE-2005-3556

Multiple cross-site scripting (XSS) vulnerabilities in PHPlist 2.10.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listname parameter in (a) admin/editlist.php, (2) title parameter in (b) admin/spageedit.php, (3) title field in (c) admin/template.php, (4) filter, (5) delete, and (6) start parameters in (d) admin/eventlog.php, (7) id parameter in (e) admin/configure.php, (8) find parameter in (f) admin/users.php, (9) start parameter in (g) admin/admin.php, and (10) action parameter in (h) admin/fckphplist.php.

• http://osvdb.org/20570
• http://osvdb.org/20571
• http://osvdb.org/20572
• http://osvdb.org/20573
• http://osvdb.org/20574
• http://osvdb.org/20575
• http://osvdb.org/20576
• http://secunia.com/advisories/17476Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/416005/30/0/threaded
• http://www.securityfocus.com/bid/15350
• http://www.trapkit.de/advisories/TKADV2005-11-001.txtExploit, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2005/2345
• http://osvdb.org/20570
• http://osvdb.org/20571
• http://osvdb.org/20572
• http://osvdb.org/20573
• http://osvdb.org/20574
• http://osvdb.org/20575
• http://osvdb.org/20576
• http://secunia.com/advisories/17476Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/416005/30/0/threaded
• http://www.securityfocus.com/bid/15350
• http://www.trapkit.de/advisories/TKADV2005-11-001.txtExploit, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2005/2345

Published

Nov 16, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-3550Directory traversal vulnerability in admin.php in toendaCMS …
• CVE-2005-3551toendaCMS before 0.6.2 stores user account and session data …
• CVE-2005-3552Multiple cross-site scripting (XSS) vulnerabilities in PHPKI…
• CVE-2005-3553Multiple SQL injection vulnerabilities in include.php in PHP…
• CVE-2005-3554Multiple eval injection vulnerabilities in the help function…
• CVE-2005-3555Multiple SQL injection vulnerabilities in PHPlist 2.10.1 and…
• CVE-2005-3557Directory traversal vulnerability in admin/defaults.php in P…
• CVE-2005-3558PHP file inclusion vulnerability in index.php in OSTE 1.0 al…
• CVE-2005-3559Directory traversal vulnerability in vmail.cgi in Asterisk 1…
• CVE-2005-3560Zone Labs (1) ZoneAlarm Pro 6.0, (2) ZoneAlarm Internet Secu…
• CVE-2005-3561Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2005-3562Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…