Event Management System
CVE-2026-2691
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /admin/manage_register.php
-
ExploitInject SQL payload into ID parameter
-
ExecutionExecute arbitrary SQL queries
-
ImpactExtract or modify database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default configurations of itsourcecode Event Management System 1.0 with /admin/manage_register.php exposed to network access. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this flaw, sql injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /admin/manage_register.php, potentially leading to unauthorized data access, modification, or deletion. Public exploit code exists for this vulnerability, and no patch is currently available, creating significant risk for unpatched deployments.
Earlier versions of this analysis (1)
A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Event Management System. A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Know when Event Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in itsourcecode Event Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_register.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Executive ViewAI
A high-severity vulnerability (CVE-2026-2691) affecting the Event Management System 1.0 has been publicly disclosed with active exploit code available. This vulnerability impacts the admin registration functionality and poses an immediate risk to unauthorized administrative access, potentially compromising event data integrity and system administration capabilities across the organization.
- Implement WAF rules to block or monitor POST/GET requests to /admin/manage_register.php with suspicious parameters. 2) Restrict network access to /admin/ paths via IP allowlisting (corporate networks/VPN only). 3) Disable the registration functionality if not operationally required. 4) Enable verbose logging and alerting on admin panel access attempts. 5) Implement rate limiting on registration endpoints. 6) Consider temporary take-offline of Event Management System 1.0 until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Event Management System
View allSourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/lo
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. Rat
Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_E
Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email,
SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID p
SQL injection in itsourcecode Event Management System 1.0's admin login endpoint allows unauthenticated remote attackers
SQL injection in itsourcecode Event Management System 1.0's booking management interface allows unauthenticated remote a
SQL injection in itsourcecode Event Management System 1.0 via the ID parameter in /admin/manage_user.php allows unauthen
A vulnerability, which was classified as critical, was found in Codezips Event Management System 1.0. Rated medium sever
Reflected cross-site scripting in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to in
Exploit-DB