Nadh

Listmonk

6 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.1

CVE-2026-34828

Exploit
  • EPSS 0.01%
  • Veröffentlicht 02.04.2026 17:32:24
  • Zuletzt bearbeitet 15.04.2026 17:45:10

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account securit...

5.4

CVE-2026-34584

  • EPSS 0.03%
  • Veröffentlicht 02.04.2026 17:31:37
  • Zuletzt bearbeitet 10.04.2026 02:03:22

listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists (which they don't have access to) under...

5.4

CVE-2026-21483

Exploit
  • EPSS 0.01%
  • Veröffentlicht 02.01.2026 20:57:29
  • Zuletzt bearbeitet 25.02.2026 15:20:58

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user ...

6.1

CVE-2025-58430

Exploit
  • EPSS 0.02%
  • Veröffentlicht 09.09.2025 19:37:45
  • Zuletzt bearbeitet 10.10.2025 21:49:03

listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie `session` there included `nonce`. The value is not checked and validated by the ba...

6.5

CVE-2025-49136

Exploit
  • EPSS 61.76%
  • Veröffentlicht 09.06.2025 16:21:48
  • Zuletzt bearbeitet 11.07.2025 17:23:30

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the `env` and `expandenv` template functions which is enabled by default in Sprig enables capturing of env variables on ...

6.5

CVE-2025-46011

  • EPSS 0.29%
  • Veröffentlicht 04.06.2025 00:00:00
  • Zuletzt bearbeitet 15.10.2025 17:54:53

Listmonk v4.1.0 (fixed in v5.0.0) is vulnerable to SQL Injection in the QuerySubscribers function which allows attackers to escalate privileges.