CVE-2023-28731

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected.

This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20 CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Mar 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-287327.5Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself a CVE-2023-287336.1AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authe CVE-2023-287366.7Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalatio CVE-2023-287377.8Improper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escal CVE-2023-287387.8Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalatio CVE-2023-287397.8Incorrect default permissions in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to pot CVE-2023-28745.5A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x80 CVE-2023-287407.8Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated u CVE-2023-287417.8Buffer overflow in some Intel(R) QAT drivers for Windows - HW Version 1.0 before version 1.10 may allow an authenticated user to potentially CVE-2023-287428.8When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions whi CVE-2023-287437.8Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalatio CVE-2023-287448.8A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A specially crafted PDF