AcyMailing by Acyba, versions 5.9.5 and previous, CSV Injection (see https://vel.joomla.org/articles/2140-introducing-csv-injection )

Resolution: update to 5.9.6

update notice: https://www.acyba.com/acymailing/change-log.html