CVE-2026-112141
7.3HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote unauthenticated attackers can read, modify, or delete database contents via SQL injection. All they need is network access to the web application.
Root cause
The Registration-Edit Handler in doedit.php passes unsanitized request parameters directly into mysqli_query calls.
Affected systems
satya-vinay Events-Management-System commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a and earlier.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch exists. Block public access to doedit.php at the web server reverse proxy or take the application offline until parameters are parameterized.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipulation of the argument id/name/title/year/gender/fromdate/todate/people causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.