CVE-2023-28733

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

AnyMailing Joomla Plugin is vulnerable to stored cross site scripting (XSS) in templates and emails of AcyMailing, exploitable without authentication when access is granted to the campaign's creation on front-office.

This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-20 CWE-116 CWE-79

Affected software

Vendor	Product	Versions
AcyMailing	Newsletter Plugin for Joomla in the Enterprise version	< 8.3.0

References

https://www.acymailing.com/change-log/Release Notes
https://www.bugbounty.ch/advisories/CVE-2023-28733Third Party Advisory
https://www.acymailing.com/change-log/Release Notes
https://www.bugbounty.ch/advisories/CVE-2023-28733Third Party Advisory

Timeline

Published: Mar 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-287366.7Buffer overflow in some Intel(R) SSD Tools software before version mdadm-4.2-rc2 may allow a privileged user to potentially enable escalatio CVE-2023-287377.8Improper initialization in some Intel(R) Aptio* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escal CVE-2023-287387.8Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalatio CVE-2023-287397.8Incorrect default permissions in some Intel(R) Chipset Driver Software before version 10.1.19444.8378 may allow an authenticated user to pot CVE-2023-28745.5A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x80 CVE-2023-287407.8Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated u CVE-2023-287417.8Buffer overflow in some Intel(R) QAT drivers for Windows - HW Version 1.0 before version 1.10 may allow an authenticated user to potentially CVE-2023-287428.8When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions whi CVE-2023-287437.8Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalatio CVE-2023-287448.8A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. A specially crafted PDF CVE-2023-287456.7Uncontrolled search path in Intel(R) QSFP+ Configuration Utility software, all versions, may allow an authenticated user to potentially enab CVE-2023-287466.5Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processor