Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
phpList/phplist3
main @ 28cc388
24
Fixes
0
CVEs
HIGH
Peak severity
23.5%
Coverage
Highlights
Auth Bypass: 6 prior fixes. Scrutinize any change in this area.
public_html/lists/admin/auth/phplist_auth.inc: most-fixed (2 issues). Treat as high-risk during review.
21 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple distinct auth bypass vectors were fixed, including insecure password auto-reset, loose equality comparisons, missing ownership filters, and plaintext password handling, indicating a systemic weakness in authentication and authorization logic.
CSRF: A large number of CSRF vulnerabilities were fixed across many admin endpoints, including token predictability, timing attacks, and missing token verification on state-changing operations, indicating a broad gap in CSRF protection that was addressed piecemeal.
Access Control Bypass: Access control bypasses were found in Apache configuration, plugin inclusion, permission setting, and statistics viewing, showing that authorization checks were missing or incorrectly implemented in several places.