CVE-2026-60025
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Joomla extension Events Booking prior to version 5.8.0 has a file upload endpoint lacking CSRF protection, allowing user enumeration.
Risk Assessment
An attacker can exploit the missing CSRF protection to perform unauthorized actions on behalf of an administrator, including user enumeration, compromising confidentiality.
Recommendation
Update the Events Booking extension to version 5.8.0 or later, which includes the CSRF fix.
Other vulnerabilities in Events Booking
See all- CVE-2026-60024Critical
The Joomla extension Events Booking prior to version 5.8.0 by default allows unauthenticated users to upload media assets. This is an insecure default configuration.
- CVE-2026-63047High
Joomla Extension Events Booking from joomdonation.com versions 5.0.0-5.8.1 did not properly verify that an actor is allowed to download invoice information, leading to data exfiltration.
- CVE-2026-58149Medium
The Joomla extension Events Booking before version 5.8.0 is vulnerable to unauthenticated user enumeration, allowing retrieval of usernames and email addresses.
Original NVD description (English source)
Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.