Joomdonation Com
Monthly
Unauthorized invoice disclosure in the Events Booking extension for Joomla (versions 5.0 through 5.8.1) lets remote unauthenticated attackers download invoice data belonging to other users because the extension fails to verify the requester's authorization. Rated CVSS 7.5 (confidentiality-only impact), with no public exploit identified at time of analysis and CISA SSVC marking exploitation status as none. The flaw is an access-control gap (CWE-284) tagged as an authentication/authorization bypass.
Unauthenticated media upload in the Events Booking extension for Joomla (versions 1.0 through 5.8.0, developed by joomdonation.com) allows any remote user to push media assets to the server without authentication because the feature is enabled by default. Assigned CVSS 9.8 and CWE-1188 (insecure default configuration), the flaw is reported by Joomla/joomdonation and tracked as EUVD-2026-45184; there is no public exploit identified at time of analysis and the EPSS probability is low (0.15%, 4th percentile). Fixed in version 5.8.0.
Cross-site request forgery in the Events Booking extension for Joomla (all versions through 5.8.0) lets a remote attacker abuse an unauthenticated frontend file-upload endpoint that lacks anti-CSRF token validation. By luring a logged-in victim to a malicious page, an attacker can force the victim's browser to submit a forged upload request, potentially planting malicious files on the server; the CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.10%, 1st percentile).
SQL injection in EDocman, the Joomla download/document manager extension by Joomdonation, allows remote unauthenticated attackers to inject arbitrary SQL through the extension's request handling (CWE-89). The CVSS 4.0 score of 8.7 reflects high confidentiality impact with no required privileges or user interaction, meaning database contents can be extracted directly over the network. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated user enumeration in the Events Booking extension for Joomla (versions 1.0 through 5.8.0) exposes registered account usernames and email addresses to any unauthenticated remote attacker. The flaw requires no credentials, no user interaction, and no special configuration beyond the extension being installed and active - making it trivially accessible to automated tooling. While not confirmed actively exploited (no CISA KEV listing) and carrying a low EPSS probability of 0.15%, the harvested PII enables follow-on phishing, credential stuffing, or account targeting campaigns against Joomla site users.
Unauthorized invoice disclosure in the Events Booking extension for Joomla (versions 5.0 through 5.8.1) lets remote unauthenticated attackers download invoice data belonging to other users because the extension fails to verify the requester's authorization. Rated CVSS 7.5 (confidentiality-only impact), with no public exploit identified at time of analysis and CISA SSVC marking exploitation status as none. The flaw is an access-control gap (CWE-284) tagged as an authentication/authorization bypass.
Unauthenticated media upload in the Events Booking extension for Joomla (versions 1.0 through 5.8.0, developed by joomdonation.com) allows any remote user to push media assets to the server without authentication because the feature is enabled by default. Assigned CVSS 9.8 and CWE-1188 (insecure default configuration), the flaw is reported by Joomla/joomdonation and tracked as EUVD-2026-45184; there is no public exploit identified at time of analysis and the EPSS probability is low (0.15%, 4th percentile). Fixed in version 5.8.0.
Cross-site request forgery in the Events Booking extension for Joomla (all versions through 5.8.0) lets a remote attacker abuse an unauthenticated frontend file-upload endpoint that lacks anti-CSRF token validation. By luring a logged-in victim to a malicious page, an attacker can force the victim's browser to submit a forged upload request, potentially planting malicious files on the server; the CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.10%, 1st percentile).
SQL injection in EDocman, the Joomla download/document manager extension by Joomdonation, allows remote unauthenticated attackers to inject arbitrary SQL through the extension's request handling (CWE-89). The CVSS 4.0 score of 8.7 reflects high confidentiality impact with no required privileges or user interaction, meaning database contents can be extracted directly over the network. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated user enumeration in the Events Booking extension for Joomla (versions 1.0 through 5.8.0) exposes registered account usernames and email addresses to any unauthenticated remote attacker. The flaw requires no credentials, no user interaction, and no special configuration beyond the extension being installed and active - making it trivially accessible to automated tooling. While not confirmed actively exploited (no CISA KEV listing) and carrying a low EPSS probability of 0.15%, the harvested PII enables follow-on phishing, credential stuffing, or account targeting campaigns against Joomla site users.