{"affected":[{"defaultStatus":"unaffected","product":"acymailing.com AcyMailing extension for Joomla","source":"CNA: Joomla","vendor":"Datasolution","versions":[{"status":"affected","version":"1.0-10.11.0"}]}],"cveId":"CVE-2026-56292","cwes":["CWE-89"],"description":"Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.","epss":{"date":"2026-11-12","percentile":0.72522,"score":0.01381},"exploits":[],"kev":null,"metrics":[{"score":9.2,"severity":"critical","source":"CNA: Joomla","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H","version":"4.0"}],"modifiedAt":1794506630559,"publishedAt":1783604979916,"references":[{"source":"CNA: Joomla","tags":["product"],"url":"https://www.acymailing.com/"},{"source":"CNA: Joomla","tags":["third-party-advisory"],"url":"https://mysites.guru/blog/acymailing-sql-injection-disclosure/"}],"remediation":[],"revision":"ffe97af7e28ab72072ddcc6405c173d5d270723d9470a9c7c924075f708854ce","sources":[{"modifiedAt":1794506630559,"name":"CNA: Joomla","retrievedAt":1794510620224,"url":"https://www.cve.org/CVERecord?id=CVE-2026-56292"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794510640852,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56292"}],"ssvc":{"assessedAt":1783607924551,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1","updatedAt":1794510640852}