Vulnerability GO-2025-3943
Advisory details are being prepared in the background.
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 year ago
September 17, 2025 at 05:03 PM UTC
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
*
*
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 hours ago
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
Unknown
4 months ago
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
High Risk
7 months ago
listmonk's active sessions remain valid after password reset and password change
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
Unknown
9 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
<1.1.1-0.20251231125615-74dc5a01cfbb GO-2026-4277
<1.1.1-0.20251231125615-74dc5a01cfbb GO-2026-4277
Medium Risk
10 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb GHSA-jmr4-p576-v565
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb GHSA-jmr4-p576-v565
Impacted packages
Timeline
Published
1 year ago
September 17, 2025 at 05:03 PM UTC
Last Modified
8 months ago
March 03, 2026 at 04:57 AM UTC