PT-2023-27185 · Joomla · Acymailing Enterprise

Name of the Vulnerable Software and Affected Versions: AcyMailing Enterprise component for Joomla affected versions not specified Description: The issue is related to an Improper Access Control vulnerability in the AcyMailing Enterprise component for Joomla. It allows unauthorized removal of...

PT-2023-27183 · Joomla · Acymailing Enterprise

Name of the Vulnerable Software and Affected Versions: AcyMailing Enterprise component for Joomla versions 6.7.0 through 8.6.3 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. This enables potential attackers to...

PT-2023-27182

Name of the Vulnerable Software and Affected Versions AcyMailing component for Joomla affected versions not specified Description The issue allows remote code execution due to an Unrestricted Upload of File with Dangerous Type vulnerability in the AcyMailing component for Joomla. Recommendations ...

CVE-2023-39972: Improper Access Control

Improper Access Control vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized users to create new mailing lists...

CVE-2023-28733

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting XSS in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...

CVE-2023-28733

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting XSS in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...

Cross site scripting

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting XSS in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...

CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting XSS in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...

CVE-2023-28733

AnyMailing Joomla Plugin Enterprise versions prior to 8.3.0 are affected by a stored XSS in templates and emails of AcyMailing. The vulnerability is exploitable without authentication when access to the campaign creation on the front office is granted. The root cause is a stored cross-site script...

CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting XSS in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...

CVE-2023-28732 Missing access control affecting the AcyMailing plugin for Joomla

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plug...

CVE-2023-28732 Missing access control affecting the AcyMailing plugin for Joomla

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plug...

CVE-2023-28731 Unauthenticated RCE affecting the AcyMailing plugin for Joomla

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...

Acyba AcyMailing 跨站脚本漏洞

Acyba AcyMailing is a suite of newsletter and marketing automation software from the Acyba team in France. A security vulnerability exists in Acyba AcyMailing prior to version 8.3.0 that stems from the presence of a stored cross-site scripting XSS vulnerability...

AcyMailing Joomla Component 路径遍历漏洞

AcyMailing Joomla Component is an email marketing component used in the Joomla content management system. A security vulnerability exists in AcyMailing Joomla Component versions prior to 8.3.0 that stems from incorrect input validation leading to the disclosure of sensitive information...

Acyba AcyMailing 代码问题漏洞

Acyba AcyMailing is a suite of newsletter and marketing automation software from the Acyba team in France. A security vulnerability exists in Acyba AcyMailing versions prior to 8.3.0, which stems from incorrect input validation leading to the unrestricted upload of dangerous files...

CVE-2021-24288

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim...

Design/Logic Flaw

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim...

CVE-2021-24288

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim...

CVE-2021-24288

The CVE-2021-24288 entry maps to a concrete issue in WordPress AcyMailing before 7.5.0: an open redirect caused by improper sanitization of the redirect parameter. An attacker can craft a link (via GET after switching from POST) that redirects victims to a malicious landing page. The Nuclei and R...