335 matches found
AcyMailing < 10.11.1 - Unauthenticated SQL Injection
AcyMailing component for Joomla 10.11.1 contains a sql injection caused by improper input sanitization, letting attackers access unauthorized database data, exploit requires crafted input. id: CVE-2026-56292 info: name: AcyMailing 10.11.1 - Unauthenticated SQL Injection author: str4k3r severity:...
WordPress AcyMailing <7.5.0 - Open Redirect
WordPress AcyMailing plugin before 7.5.0 contains an open redirect vulnerability due to improper sanitization of the redirect parameter. An attacker turning the request from POST to GET can craft a link containing a potentially malicious landing page and send it to the user. id: CVE-2021-24288...
CVE-2026-120467
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...
CVE-2026-120469
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitrary external site, which is usable for...
CVE-2026-120470
Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and...
CVE-2026-120466
Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker who knows a subscriber's email address can unsubscribe that subscriber from one mailing list or from every mailing lists, without proving that t...
CVE-2026-120468
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with thei...
CVE-2026-120471
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher...
CVE-2026-118495
Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email addre...
EUVD-2026-124610
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...
CVE-2026-120467
The AcyMailing extension for Joomla and WordPress (versions 1.0.0 - 11.1.1 ) is vulnerable to an authorization bypass due to a failure to bind subscriber identities to the records being acted upon. This flaw allows an authenticated user of any privilege level to subscribe or unsubscribe any other...
CVE-2026-120467 Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1 - An authenticated user of any privilege level can subscribe or unsubscribe any other subscriber to or from any mailing list of the site...
CVE-2026-120468
The AcyMailing Joomla extension (versions 1.0.0 - 11.1.1 ) is vulnerable to an unauthenticated disclosure of mailing list metadata . An attacker can retrieve information for every mailing list on the site, including those not publicly visible or restricted by access levels. Exposed data includes ...
CVE-2026-120468 Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with thei...
EUVD-2026-124609
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with thei...
CVE-2026-120471
The AcyMailing Joomla extension versions 1.0.0 through 11.1.1 is vulnerable to an access control issue where an unauthenticated visitor can cause site modules to be rendered regardless of their restricted Joomla access level . This flaw results in the disclosure of content intended for higher vie...
CVE-2026-120471 Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher...
EUVD-2026-124607
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which discloses content reserved for a higher...
CVE-2026-120470
The AcyMailing extension for Joomla and WordPress (versions 1.0.0 - 11.1.1 ) is vulnerable to a missing authorization issue (CWE-862 ). An unauthenticated attacker can bypass visibility checks to read the online versions of private email campaigns, including those that were unpublished after bein...
CVE-2026-120470 Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1
Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaigns unpublished after being sent and...