CVEvulnerability

CVE-2023-28733

6.1 MEDIUM Published 2023-03-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-03-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-116, CWE-20, CWE-79

Description

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Affected configurations

• acymailing acymailing (< 8.3.0)

Related

Weakness · CWE (3)

  • CWE-116 Improper Encoding or Escaping of Output weakness
  • CWE-20 Improper Input Validation weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References