CVE-2026-60025

CVE-2026-60025: Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0

Vendor Joomdonation.com

Product Events Booking extension for Joomla

Weakness CWE-352 · CSRF

Published July 17, 2026

Last update July 17, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.

Key dates

02Disclosure timeline

July 17, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-60025 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities

04Related CVE

CVE-2016-20074 WordPress Lazy Content Slider Plugin 3.4 CSRF CVE-2026-57747 WordPress Booked plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2026-6455 WP Contact Form 7 DB Handler <= 3.0 - Cross-Site Request Forgery to Arbitrary File Deletion via 'contact_form' Parameter CVE-2026-8944 Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter CVE-2026-57751 WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability