AcyMailing vulnerabilities
We track 6 vulnerabilities in AcyMailing products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on September 26, 2026.
Latest AcyMailing vulnerabilities
- 8.1 High severity
AcyMailing Enterprise extension for Joomla: Unrestricted Upload of File with Dangerous Type
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could emai
- 8.1 High severity
AcyMailing extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including fil
- 7.5 High severity
acymailing.com AcyMailing extension for Joomla: Improper Neutralization of Special Elements used in an SQL Command
Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.
- 8.8 High severity
AcyMailing – An Ultimate Newsletter Plugin and…: Unrestricted Upload of File with Dangerous Type
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the acym_extractArchive function in all versions up to, and inclu
- 7.5 High severity
Newsletter Plugin for Joomla: Improper Limitation of a Pathname to a Restricted Directory
Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office. This
- 9.8 Critical severity
Newsletter Plugin for Joomla in the Enterprise…: Unrestricted Upload of File with Dangerous Type
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin