Vulnerability GO-2026-4277
Advisory details are being prepared in the background.
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
9 months ago
January 12, 2026 at 05:39 PM UTC
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover in github.com/knadh/listmonk
<1.1.1-0.20251231125615-74dc5a01cfbb
<1.1.1-0.20251231125615-74dc5a01cfbb
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 hours ago
listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
<1.1.1-0.20260619102436-c0a6525009a6 GHSA-xgjr-7j9q-2h4r
Unknown
4 months ago
listmonk's active sessions remain valid after password reset and password change in github.com/knadh/listmonk
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GO-2026-5414
High Risk
7 months ago
listmonk's active sessions remain valid after password reset and password change
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
>=1.1.1-0.20241028090858-319053dd7a90 <1.1.1-0.20260329113754-1b5e8d38c778 GHSA-h5j9-cvrw-v5qh
Medium Risk
10 months ago
listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb GHSA-jmr4-p576-v565
>=1.1.1 <6.0.0, <1.1.1-0.20251231125615-74dc5a01cfbb GHSA-jmr4-p576-v565
Unknown
1 year ago
listmonk: CSRF to XSS Chain can Lead to Admin Account Takeover in github.com/knadh/listmonk
* GO-2025-3943
* GO-2025-3943
Impacted packages
Timeline
Published
9 months ago
January 12, 2026 at 05:39 PM UTC
Last Modified
9 months ago
January 12, 2026 at 06:11 PM UTC