CVE-2026-112142
7.3HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Remote, unauthenticated attackers can read, modify, or delete database contents by sending malicious requests to the application. Exploit code is publicly available.
Root cause
The Registration-Delete Handler in dodelete.php fails to sanitize or parameterize the 'ID' parameter before concatenating it into a SQL query.
Affected systems
satya-vinay Events-Management-System commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a and earlier.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official fix exists as the maintainer has not responded. Restrict network access to dodelete.php or modify the file directly to use parameterized database queries for the 'ID' parameter.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.