Vulnerability GHSA-jmr4-p576-v565
Advisory details are being prepared in the background.
Medium Risk
MEDIUM RISK
CVSS Score: 6.0
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
10 months ago
January 02, 2026 at 11:04 PM UTC
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 hours ago
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
Unknown
4 months ago
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
High Risk
7 months ago
listmonk's active sessions remain valid after password reset and password change
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
Unknown
9 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
<1.1.1-0.20251231125615-74dc5a01cfbb GO-2026-4277
<1.1.1-0.20251231125615-74dc5a01cfbb GO-2026-4277
Unknown
1 year ago
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
* GO-2025-3943
* GO-2025-3943
Impacted packages
Timeline
Published
10 months ago
January 02, 2026 at 11:04 PM UTC
Last Modified
9 months ago
February 03, 2026 at 03:14 AM UTC