The direct_mail extension up to and including 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
dkd direct mail