Events Management System EUVD-2026-104261

Exploitation requires network reach to the application's dodelete.php script (the Registration-Delete Handler) and the ability to supply the ID parameter; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against a default deployment. The only practical limiting factors are that a running, internet- or network-reachable instance of satya-vinay Events-Management-System must be exposed, and the product's niche nature means few such instances exist; no special feature toggle or non-default configuration is indicated by the description.

This is a CWE-89 SQL injection in the dodelete.php 'Registration-Delete Handler' of satya-vinay Events-Management-System, reachable via the ID parameter. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated issue, which normally signals high priority; however, the impact metrics are uniformly Low (VC:L/VI:L/VA:L), yielding only a Medium base score of 5.5 - unusual for SQLi, which often permits full database read/write, so the Low impact rating from VulDB may understate real data exposure and should be verified against the actual query. The E:P (Proof-of-Concept) exploit maturity aligns with the reported publicly available POC. There is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation - exposure is driven by POC availability plus trivial exploitability, not confirmed attacks. Net assessment: genuinely exploitable and unauthenticated, but the real-world risk is tempered by the product's obscurity (a small GitHub project) and the unpatched rolling-release status; treat as a moderate, opportunistic-scan-level risk rather than a strategic emergency. Note the conflict worth flagging: SQL injection typically warrants higher-than-Low confidentiality/integrity impact - verify the Low CIA ratings against the vulnerable query behavior.

A remote, unauthenticated attacker sends a crafted HTTP request to dodelete.php with a malicious ID parameter, injecting SQL that the backend executes against the registration database. Because the attack is network-based with low complexity and requires no privileges or user interaction, it can be automated; a public proof-of-concept exists (referenced in the vendor's GitHub issue #3), lowering the bar for exploitation.