Read the docs

acymailing.com

Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

acymailing.com records in CISA KEV

No acymailing.com vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Acymailing 13 records MEDIUM

Records

13 records in Acymailing · all components

TI-2023-13245 CVE-2023-28731 · GHSA-2qgx-8w4f-jc5v

Unauthenticated RCE affecting the AcyMailing plugin for Joomla

Priority MEDIUM 52

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01782 Published 2023-03-30 Fixed CWE-20
TI-2026-40657 CVE-2026-56292 · GHSA-3m45-8387-4837

SQL injection in acymailing.com AcyMailing extension for Joomla

Priority MEDIUM 44

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.01381 Published 2026-07-09 No fix listed CWE-89
TI-2026-63343 CVE-2026-94132 · GHSA-x2ch-94w5-cr2g

Unrestricted file upload in acymailing.com AcyMailing Enterprise extension for Joomla

Priority MEDIUM 43

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no e…

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.0047 Published 2026-09-26 No fix listed CWE-434
TI-2024-06844 CVE-2024-7384 · GHSA-wv55-98hp-hrf7

AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function

Priority MEDIUM 42

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive f…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00958 Published 2024-08-22 No fix listed CWE-434
TI-2023-13246 CVE-2023-28732 · GHSA-8j2h-rjqx-hfj6

Missing access control affecting the AcyMailing plugin for Joomla

Priority MEDIUM 40

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the c…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00633 Published 2023-03-30 Fixed CWE-20
TI-2023-13247 CVE-2023-28733 · GHSA-3jpf-c526-5cw2

Stored XSS affecting the AcyMailing plugin for Joomla

Priority LOW 38

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0037 Published 2023-03-30 Fixed CWE-116
TI-2026-63342 CVE-2026-94131 · GHSA-657v-94xx-8q7f

SQL injection in acymailing.com AcyMailing extension for Joomla

Priority LOW 36

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file w…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00263 Published 2026-09-26 No fix listed CWE-89
TI-2021-06580 CVE-2021-24288 · GHSA-vrm9-x4ww-qpgw

AcyMailing < 7.5.0 - Unauthenticated Open Redirect

Priority LOW 31

When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01939 Published 2021-05-17 Fixed in 7.5.0 CWE-601
Open these records in search →