Event Management System
CVE-2026-3042
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend HTTP request to /admin/index.php
-
ExploitInject SQL payload in ID parameter
-
ExecutionExecute unauthorized database queries
-
ImpactExtract or modify sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default itsourcecode Event Management System 1.0 with /admin/index.php endpoint accessible. |
| Impact | CVSS 7.3 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. Public exploit/POC available. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this flaw, sql injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID parameter in /admin/index.php and execute arbitrary SQL queries. Public exploit code exists for this vulnerability, and no patch is currently available. Attackers can leverage this to access, modify, or delete sensitive data with confidentiality, integrity, and availability impact.
Earlier versions of this analysis (1)
A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. [CVSS 7.3 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Affects Event Management System. A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Know when Event Management System gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in itsourcecode Event Management System 1.0. The affected element is an unknown function of the file /admin/index.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
Executive ViewAI
A high-severity vulnerability in itsourcecode Event Management System 1.0 poses a significant risk to organizations using this software, particularly affecting administrative functions. With public exploits available and no patch currently available, this requires immediate action to prevent unauthorized access to critical event management infrastructure.
Implement WAF rules to block suspicious requests to /admin/index.php; restrict administrative access via IP whitelisting or VPN-only requirements; disable the Event Management System if not critical to operations; increase monitoring and logging for administrative interface access; consider network segmentation to isolate the affected application.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
More in Event Management System
View allSourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/lo
Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. Rat
Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_E
Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email,
SQL injection in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to manipulate the ID p
SQL injection in itsourcecode Event Management System 1.0's admin login endpoint allows unauthenticated remote attackers
SQL injection in itsourcecode Event Management System 1.0's booking management interface allows unauthenticated remote a
SQL injection in itsourcecode Event Management System 1.0 via the ID parameter in /admin/manage_user.php allows unauthen
A vulnerability, which was classified as critical, was found in Codezips Event Management System 1.0. Rated medium sever
Reflected cross-site scripting in itsourcecode Event Management System 1.0 allows unauthenticated remote attackers to in
Exploit-DB