PT-2026-33267

Name of the Vulnerable Software and Affected Versions AcyMailing versions 9.11.0 through 10.8.1 Description A missing capability check on the 'wp ajax acymailing router' AJAX handler allows authenticated attackers with Subscriber-level access or higher to access admin-only controllers, including...

CVE-2020-10934

Acyba AcyMailing before 6.9.2 mishandles file uploads by admins...

EUVD-2021-11202

Malware in sbrugna...

EUVD-2015-7262

Malware in sbrugna...

EUVD-2020-3340

Malware in sbrugna...

EUVD-2023-43666

Malicious code in bioql PyPI...

EUVD-2025-3821

Malicious code in bioql PyPI...

EUVD-2023-43664

Malicious code in bioql PyPI...

EUVD-2023-43663

Malicious code in bioql PyPI...

EUVD-2023-32371

Malicious code in bioql PyPI...

EUVD-2023-43667

Malicious code in bioql PyPI...

EUVD-2023-46358

Malicious code in bioql PyPI...

EUVD-2023-43665

Malicious code in bioql PyPI...

CVE-2023-41867

Unauth. Reflected Cross-Site Scripting XSS vulnerability in AcyMailing Newsletter Team AcyMailing plugin = 8.6.2 versions...

CVE-2023-39970

Unrestricted Upload of File with Dangerous Type vulnerability in AcyMailing component for Joomla. It allows remote code execution...

CVE-2023-39974

Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list...

CVE-2021-24288

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim...

CVE-2015-7338

SQL Injection exists in AcyMailing Joomla Component before 4.9.5 via exportgeolocorder in a geolocationlongitude request to index.php...

CVE-2025-24617

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 9.11.1...

CVE-2025-24617

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 9.11.1...