Event Management System
CVE-2026-2217
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /admin/manage_user.php
-
ExploitInject SQL payload in ID parameter
-
ExecutionExecute arbitrary SQL queries
-
ImpactExtract or modify database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against itsourcecode Event Management System 1.0 with /admin/manage_user.php endpoint accessible. SQL injection possible in ID parameter without authentication required. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this flaw, sql injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in itsourcecode Event Management System 1.0 via the ID parameter in /admin/manage_user.php allows unauthenticated remote attackers to execute arbitrary SQL queries and potentially access or modify sensitive data. Public exploit code exists for this vulnerability, and no patch is currently available, putting all affected installations at immediate risk.
Earlier versions of this analysis (1)
A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Event Management System. A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Know when Event Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was found in itsourcecode Event Management System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used.
Executive ViewAI
CVE-2026-2217 affects the Event Management System 1.0 admin interface with a HIGH severity rating and active public exploits, creating immediate risk to administrative functions and potentially sensitive data. Without an available patch, this vulnerability requires urgent interim protection measures to prevent unauthorized access to user management capabilities.
Implement WAF rules to restrict access to /admin/manage_user.php; apply network segmentation limiting admin interface access to trusted administrative networks only; disable user management functionality if operationally feasible; enforce multi-factor authentication on all admin accounts; enable comprehensive logging and real-time alerting on admin panel access attempts; conduct daily security audits of admin activities; consider taking the vulnerable application offline pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Event Management System
View allSourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/lo
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. Rat
Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_E
Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email,
SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID p
SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID p
SQL injection in itsourcecode Event Management System 1.0's admin login endpoint allows unauthenticated remote attackers
SQL injection in itsourcecode Event Management System 1.0's booking management interface allows unauthenticated remote a
A vulnerability, which was classified as critical, was found in Codezips Event Management System 1.0. Rated medium sever
Reflected cross-site scripting in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to in
Exploit-DB