PT-2026-56808 · Joomla · Acymailing

Phil Taylor · Published 2026-07-09 · Updated 2026-07-09 · CVE-2026-56292

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions AcyMailing versions prior to 10.11.1

Description An unauthenticated SQL injection flaw exists in the AcyMailing component for Joomla. This issue allows a remote attacker to execute crafted SQL queries to gain unauthorized access to the database, potentially leading to the leakage of sensitive information such as password hashes, personal data, and general content.

Recommendations Update AcyMailing to version 10.11.1.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-56292

Affected Products

Acymailing

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-56292 · Security Note
• https://mysites.guru/blog/acymailing-sql-injection-disclosure · Reddit Post
• https://acymailing.com · Note
• https://twitter.com/CVEnew/status/2075229327919079448 · Twitter Post