Events-Management-System CVE-2026-112141

Exploitation requires reaching the doedit.php endpoint of the Registration-Edit Handler and supplying attacker-controlled values in the id, name, title, year, gender, fromdate, todate, or people parameters, which flow unsanitized into a mysqli_query call. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required and exploitation works against the application as shipped. The primary limiting factor is deployment: the product is a niche, unmaintained GitHub project, so the endpoint must be internet-reachable and the installation present; no non-default configuration or special feature toggle is indicated by the description.

Multiple signals point to a modest real-world priority despite the network-exploitable, unauthenticated nature of the flaw. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, low-complexity, unauthenticated exploitation, and CWE-89 SQL injection via mysqli_query is a well-understood, reliable class to exploit. However, the vendor-assigned impact metrics are all Low (VC:L/VI:L/VA:L) and the exploit maturity is only Proof-of-Concept (E:P), yielding a Medium 6.9 score rather than Critical. There is no CISA KEV listing and no EPSS value was provided in the input, so there is no evidence of active or widespread exploitation - exploitation status is limited to publicly available exploit code. The affected product, satya-vinay Events-Management-System, is an obscure individual GitHub project with no discernible enterprise footprint, which sharply constrains aggregate risk even though a POC exists. The low impact metrics are arguably conservative for an SQL injection that typically enables full database read/write; defenders should treat confidentiality/integrity impact as potentially higher than the vendor's Low rating if the injection reaches a privileged database connection. Net: a genuine but low-urgency issue - real because unauthenticated and POC-backed, but low-priority because of niche deployment, no active-exploitation evidence, and an unmaintained/unresponsive upstream.

A remote, unauthenticated attacker sends a crafted HTTP request to doedit.php, placing SQL metacharacters into one or more of the id, name, title, year, gender, fromdate, todate, or people parameters that are passed into a mysqli_query call. Because input is concatenated into the query unsanitized, the attacker reads or modifies arbitrary database contents (e.g., dumping registration or user records, or altering event data). A public proof-of-concept has been disclosed in the project's GitHub issue tracker, lowering the skill required to reproduce the attack.