knadh vulnerabilities

Products

• listmonk 6

Latest knadh CVEs

Newest publication first

1. CVE-2026-62361 listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

   Published 2026-07-15

   Medium·CVSS 5.5 EPSS 0.30%

   listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTabl...

2. CVE-2026-34828 listmonk: Active sessions remain valid after password reset and password change

   Published 2026-04-02

   High·CVSS 7.1 EPSS 0.31%

   listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, a session management vulnerability allows previously issued authenticated sessions to remain valid after sensitive account security changes, specifically passwo...

3. CVE-2026-34584 listmonk: Broken Access Control in CSV Import (Unauthorized List Assignment)

   Published 2026-04-02

   Medium·CVSS 5.4 EPSS 0.18%

   listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows users in a multi-user environment to access to lists (which they don't have access to) under different scenarios. This onl...

4. CVE-2026-21483 listmonk Vulnerable to Stored XSS Leading to Admin Account Takeover

   Published 2026-01-02

   Medium·CVSS 5.4 EPSS 0.23%

   listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to version 6.0.0, lower-privileged user with campaign management permissions can inject malicious JavaScript into campaigns or templates. When a higher-privileged user (Super Admin) views or preview...

5. CVE-2025-58430 listmonk Vulnerable to CSRF to XSS Chain That Can Lead to Admin Account Takeover

   Published 2025-09-09

   High·CVSS 8.6 EPSS 0.14%

   listmonk is a standalone, self-hosted, newsletter and mailing list manager. In versions up to and including 1.1.0, every http request in addition to the session cookie session there included nonce. The value is not checked and validated by the backend, removing nonce allows the r...

6. CVE-2025-49136 listmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user

   Published 2025-06-09

   Medium·CVSS 6.5 EPSS 1.6% Framework module

   listmonk is a standalone, self-hosted, newsletter and mailing list manager. Starting in version 4.0.0 and prior to version 5.0.2, the env and expandenv template functions which is enabled by default in Sprig enables capturing of env variables on host. While this may not be a prob...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.