CVE-2026-60024
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Joomla extension Events Booking prior to version 5.8.0 by default allows unauthenticated users to upload media assets. This is an insecure default configuration.
Risk Assessment
Risk of unauthorized upload of malicious files to the server, potentially leading to site compromise.
Recommendation
Update the Events Booking extension to version 5.8.0 or later.
Other vulnerabilities in Events Booking
See all- CVE-2026-63047High
Joomla Extension Events Booking from joomdonation.com versions 5.0.0-5.8.1 did not properly verify that an actor is allowed to download invoice information, leading to data exfiltration.
- CVE-2026-60025High
The Joomla extension Events Booking prior to version 5.8.0 has a file upload endpoint lacking CSRF protection, allowing user enumeration.
- CVE-2026-58149Medium
The Joomla extension Events Booking before version 5.8.0 is vulnerable to unauthenticated user enumeration, allowing retrieval of usernames and email addresses.
Original NVD description (English source)
Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.