Vulnerability record · CVE-2005-2433 · published 3 August 2005

CVE-2005-2433: Tincan phplist vulnerability

Tincan · Phplist

PhpList allows remote attackers to obtain sensitive information via a direct request to (1) about.php, (2) connect.php, (3) domainstats.php or (4) usercheck.php in public_html/lists/admin directory, (5) attributes.php, (6) dbcheck.php, (7) importcsv.php, (8) user.php, (9) usermgt.php, or (10) users.php in admin/commonlib/pages directory, (11) helloworld.php, or (12) sidebar.php in public_html/lists/admin/plugins directory, or (13) main.php in public_html/lists/admin/plugsins/defaultplugin directory, which reveal the path in an error message.

5.0 CVSS 2.0 Medium EPSS 3.4% · top 11.7%

5.0CVSS 2.0 base score

3.4%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

30References

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Phplist Tincan

References

Link	Tags
http://marc.info/?l=bugtraq&m=112258115325054&w=2
http://www.osvdb.org/18317
http://www.osvdb.org/18318
http://www.osvdb.org/18319
http://www.osvdb.org/18320
http://www.osvdb.org/18321
http://www.osvdb.org/18322
http://www.osvdb.org/18323
http://www.osvdb.org/18324
http://www.osvdb.org/18325
http://www.osvdb.org/18326
http://www.osvdb.org/18327
http://www.osvdb.org/18328
http://www.osvdb.org/18329
https://exchange.xforce.ibmcloud.com/vulnerabilities/21579
http://marc.info/?l=bugtraq&m=112258115325054&w=2
http://www.osvdb.org/18317
http://www.osvdb.org/18318
http://www.osvdb.org/18319
http://www.osvdb.org/18320
http://www.osvdb.org/18321
http://www.osvdb.org/18322
http://www.osvdb.org/18323
http://www.osvdb.org/18324
http://www.osvdb.org/18325
http://www.osvdb.org/18326
http://www.osvdb.org/18327
http://www.osvdb.org/18328
http://www.osvdb.org/18329
https://exchange.xforce.ibmcloud.com/vulnerabilities/21579

Track CVE-2005-2433 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2009-0422Tincan phplist code injection vulnerabilityDynamic variable evaluation vulnerability in lists/admin.php in phpList 2.10.8 and earlier, when register_globals is disabled, allows remote attacker…EPSS 6.2%5 Feb 2009 7.5CVE-2006-5322Tincan phplist vulnerabilityMultiple SQL injection vulnerabilities in phplist before 2.10.3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.EPSS 1.2%17 Oct 2006 7.5CVE-2005-2432Tincan phplist vulnerabilitySQL injection vulnerability in PhpList allows remote attackers to modify SQL statements via the id argument to admin pages such as (1) members or (2)…EPSS 1.3%3 Aug 2005 6.8CVE-2011-0748Tincan phplist cross-site request forgery vulnerabilityMultiple cross-site request forgery (CSRF) vulnerabilities in phpList before 2.10.13 allow remote attackers to hijack the authentication of administr…EPSS 1.5%13 Apr 2011 6.5CVE-2005-3555Tincan phplist vulnerabilityMultiple SQL injection vulnerabilities in PHPlist 2.10.1 and earlier allow authenticated remote attackers with administrator privileges to execute ar…EPSS 1.6%16 Nov 2005 5.0CVE-2008-5887Tincan phplist improper input validation vulnerabilityphplist before 2.10.8 allows remote attackers to include files via unknown vectors, related to a "local file include vulnerability."EPSS 11%12 Jan 2009 5.0CVE-2006-1746Tincan phplist path traversal vulnerabilityDirectory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the (1) GLOBALS[database…EPSS 2.4%12 Apr 2006 5.0CVE-2005-3557Tincan phplist vulnerabilityDirectory traversal vulnerability in admin/defaults.php in PHPlist 2.10.1 and earlier allows remote attackers to access arbitrary files via a .. (dot…EPSS 2.2%16 Nov 2005

Source: NIST National Vulnerability Database (record CVE-2005-2433), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.