CVE-2023-28731: acymailing Improper Input Validation
Vulnerability summary
CVE-2023-28731 is a critical (CVSS 9.8) Improper Input Validation vulnerability in acymailing. EPSS estimates a 1.78% chance of exploitation in the next 30 days, higher than 78% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 30-03-2023PublishedVulnerability first disclosed.
- 11-02-2025Last modifiedVulnerability information updated.
Description
AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.78%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.78% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugbounty.ch)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Acymailing2 products
1 vendor · 2 products
References
2 links- www.acymailing.com/change-log/Release Notes