Events Management System
Monthly
Unauthenticated remote attackers can retrieve sensitive files such as project.sql from satya-vinay Events-Management-System deployments running up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a, exposing database schema or seed content. Publicly available exploit code exists and the project has not responded to the issue report, although no CISA KEV entry confirms active exploitation. The assessed impact is read-only confidentiality loss; integrity and availability are not affected.
Missing authentication enforcement across multiple endpoints in satya-vinay Events-Management-System (rolling-release code through commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a) lets unauthenticated remote attackers reach functionality that should require login, yielding Low confidentiality, integrity, and availability impact without scope change. Publicly available exploit code exists via VulDB and GitHub issue #4, but no CISA KEV confirmation is present in the supplied data; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Because the project uses a rolling release and has not responded to the issue report, no fixed version is identified and defenders must identify exposed deployments by commit or deployment state.
SQL injection in the dodelete.php Registration-Delete Handler of satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the ID parameter and influence backend SQL queries, with low impact to confidentiality, integrity, and availability per the assessed vector. Publicly available exploit code exists via the linked GitHub issue, but the flaw is not confirmed actively exploited (not in CISA KEV); no vendor-released patch or fixed version is identified, and the project has not responded to the report.
SQL injection in satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the id, name, title, year, gender, fromdate, todate, and people parameters in doedit.php, affecting registration data with limited confidentiality, integrity, and availability impact. The application is a rolling-release GitHub project with no versioned fix, and publicly available exploit code exists; no CISA KEV entry was provided, so active exploitation is not confirmed. Real-world priority is modest because the product is niche and unmaintained, but the doedit.php endpoint must be internet-reachable for exposure.
Unauthenticated remote attackers can retrieve sensitive files such as project.sql from satya-vinay Events-Management-System deployments running up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a, exposing database schema or seed content. Publicly available exploit code exists and the project has not responded to the issue report, although no CISA KEV entry confirms active exploitation. The assessed impact is read-only confidentiality loss; integrity and availability are not affected.
Missing authentication enforcement across multiple endpoints in satya-vinay Events-Management-System (rolling-release code through commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a) lets unauthenticated remote attackers reach functionality that should require login, yielding Low confidentiality, integrity, and availability impact without scope change. Publicly available exploit code exists via VulDB and GitHub issue #4, but no CISA KEV confirmation is present in the supplied data; the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Because the project uses a rolling release and has not responded to the issue report, no fixed version is identified and defenders must identify exposed deployments by commit or deployment state.
SQL injection in the dodelete.php Registration-Delete Handler of satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the ID parameter and influence backend SQL queries, with low impact to confidentiality, integrity, and availability per the assessed vector. Publicly available exploit code exists via the linked GitHub issue, but the flaw is not confirmed actively exploited (not in CISA KEV); no vendor-released patch or fixed version is identified, and the project has not responded to the report.
SQL injection in satya-vinay Events-Management-System allows unauthenticated remote attackers to manipulate the id, name, title, year, gender, fromdate, todate, and people parameters in doedit.php, affecting registration data with limited confidentiality, integrity, and availability impact. The application is a rolling-release GitHub project with no versioned fix, and publicly available exploit code exists; no CISA KEV entry was provided, so active exploitation is not confirmed. Real-world priority is modest because the product is niche and unmaintained, but the doedit.php endpoint must be internet-reachable for exposure.