How to: CVE-2025-28073 (2025-05-08)
```
phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized.
```
- [mLniumm/CVE-2025-28073](https://github.com/mLniumm/CVE-2025-28073)