Advisories · Technology

alfio-event alf.io.

Every CVE that names alfio-event alf.io among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-50165 CVE record

CVSS 7.1 High

alf.io has Improper Access Control for Organization Owners that Exposes System Secrets
- alfio-event alf.io
- Broken access control
Not analysed yet 9 Sept 2026
CVE-2026-41412 CVE record

CVSS 4.9 Medium

alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script
- alfio-event alf.io
- Path traversal
Not analysed yet 2 Jun 2026
CVE-2026-35482 CVE record

CVSS 8.0 High

alf.io has an Authenticated RCE via Extension Script Sandbox Escape
- alfio-event alf.io
- Broken access control
Not analysed yet 2 Jun 2026
CVE-2024-45300 CVE record

CVSS 7.5 High

Bypassing promo code limitations with race conditions
- alfio-event alf.io
- Race condition
Not analysed yet 6 Sept 2024
CVE-2024-45299 CVE record

CVSS 6.5 Medium

alf.io's preloaded data as json is not escaped correctly
- alfio-event alf.io
- CWE-116
Not analysed yet 6 Sept 2024
CVE-2024-25634 CVE record

CVSS 7.2 High

IDOR make user can read e-mail log sent by other events
- alfio-event alf.io
- Information disclosure
Not analysed yet 19 Feb 2024
CVE-2024-25635 CVE record

CVSS 8.8 High

IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
- alfio-event alf.io
- CWE-612
Not analysed yet 19 Feb 2024
CVE-2024-25627 CVE record

CVSS 3.5 Low

Cross-Site Scripting (XSS) via File Upload in Alf.io
- alfio-event alf.io
- Cross-site scripting (XSS)
- Unrestricted file upload
Not analysed yet 16 Feb 2024
CVE-2024-25628 CVE record

CVSS 7.6 High

Insufficient Session Expiration in alf.io
- alfio-event alf.io
- Authentication bypass
Not analysed yet 16 Feb 2024
CVE-2023-2260 CVE record

CVSS 8.8 High

Authorization Bypass Through User-Controlled Key in alfio-event/alf.io
- alfio-event/alf.io
- Broken access control
Not analysed yet 24 Apr 2023
CVE-2023-2259 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io
- alfio-event/alf.io
- Code injection
Not analysed yet 24 Apr 2023
CVE-2023-2258 CVE record

CVSS 8.8 High

Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io
- alfio-event/alf.io
- Other injection
Not analysed yet 24 Apr 2023
CVE-2023-0301 CVE record

CVSS 4.3 Medium

Cross-site Scripting (XSS) - Stored in alfio-event/alf.io
- alfio-event/alf.io
- Cross-site scripting (XSS)
Not analysed yet 14 Jan 2023
CVE-2023-0300 CVE record

CVSS 3.5 Low

Cross-site Scripting (XSS) - Reflected in alfio-event/alf.io
- alfio-event/alf.io
- Cross-site scripting (XSS)
Not analysed yet 14 Jan 2023