satya-vinay Events-Management-System EUVD-2026-104322

Exploitation requires a network-reachable deployment of the satya-vinay Events-Management-System web application whose file/directory access controls expose sensitive resources such as project.sql to external parties (CWE-552). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or special privileges are needed against an affected instance. Limiting factors: the product is a niche, non-packaged GitHub project with no released/versioned builds, so real-world exposure depends on someone self-hosting and web-exposing the application; impact is confined to read-only confidentiality loss with no integrity or availability effect, and no vendor patch is available to define a fixed state.

This is a medium-severity information-disclosure/file-access flaw (CWE-552) with conflicting real-world urgency signals. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated attack, but the only impact is low confidentiality (VC:L) with no integrity or availability effect, yielding a 6.9 base score inflated partly by the E:P (Proof-of-Concept) exploit maturity metric. A public exploit exists (POC=YES), yet the CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation - the POC signal and the absence of KEV together suggest opportunistic rather than confirmed in-the-wild use. The target is an obscure hobby GitHub project (satya-vinay/Events-Management-System) with no versioned releases (rolling release) and the vendor has not responded to the issue report, meaning no patch is confirmed. Net assessment: a genuine but low-priority issue for the rare installations that run this specific application; the high-ish CVSS does not reflect broad real-world risk because the product footprint is tiny and the impact is read-only disclosure. Note the finding originates solely from VulDB with no independent vendor or NVD corroboration, so affected-version and root-cause detail is thin.

A remote, unauthenticated attacker identifies a web-exposed instance of the Events-Management-System application and sends a crafted request that reaches improperly protected files or directories (CWE-552), retrieving sensitive content such as the project.sql database file referenced in the advisory. Because a public proof-of-concept exists and attack complexity is low (AC:L, no authentication), the request requires no special tooling or privileges, though impact is limited to information disclosure (read-only).