Joomdonation.com vulnerabilities
Published CVEs affecting Joomdonation.com products: 6 record(s), with severity, exploitation and fixes.
Events Booking extension for Joomla 4EDocman extension for Joomla 1Membership Pro extension for Joomla 1
CVE-2026-63047
High · 7.5
CWE-284 Jul 22, 2026
Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1
Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information.
CVE-2026-62415
Critical · 9.1
CWE-1188 Jul 21, 2026
Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2
Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets.
CVE-2026-60025
High · 8.8
CWE-352 Jul 17, 2026
Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.
CVE-2026-60024
Critical · 9.8
CWE-1188 Jul 17, 2026
Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0
Joomla Extension - joomdonation.com - Insecure default configuration Events Booking < 5.8.0 - The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.
CVE-2026-58149
Medium · 5.3
CWE-200 Jul 17, 2026
Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0
Joomla Extension - joomdonation.com - User enumeration in Events Booking < 5.8.0 - The Joomla extension Events Booking is vulnerable to an unauthenticated user enumeration that allows to retrieve account usernames and email addresses.
CVE-2026-57832
High · 8.7
CWE-89 Jul 15, 2026
Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9
Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated SQL injection.