http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2748
http://int21.de/cve/CVE-2011-0748-phplist.html
phplist is a mailing list software written in PHP.
Up to version 2.10.12, it provided no protection against cross site request forgery (CSRF) at all, allowing a malicious attacker controlling a webpage an admin visits at the time being logged into phplist to gain full control over the phplist installation.
The vendor has released version 2.10.13, which fixes the vulnerability, but somehow forgot to give any credit to the person reporting the vulnerability to them.
2011-02-03: Vendor contacted
2011-02-10: Vendor releases 2.10.13 with fix
2011-04-07: Published advisory
This vulnerability was discovered by Hanno Boeck, http://www.hboeck.de, of schokokeks.org webhosting.