CVE-2023-28732

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Missing access control in AnyMailing Joomla Plugin allows to list and access files containing sensitive information from the plugin itself and access to system files via path traversal, when being granted access to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin in versions below 8.3.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20 CWE-200 CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Mar 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-287336.1AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authe CVE-2023-287366.7Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalatio CVE-2023-287377.8Improper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escal CVE-2023-287387.8Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalatio CVE-2023-287397.8Incorrect default permissions in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to pot CVE-2023-28745.5A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x80 CVE-2023-287407.8Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated u CVE-2023-287417.8Buffer overflow in some Intel(R) QAT drivers for Windows - HW Version 1.0 before version 1.10 may allow an authenticated user to potentially CVE-2023-287428.8When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions whi CVE-2023-287437.8Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalatio CVE-2023-287448.8A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A specially crafted PDF CVE-2023-287456.7Uncontrolled search path in Intel(R) QSFP+ Configuration Utility software, all versions, may allow an authenticated user to potentially enab