Advisories · Technology
Eventin.
Every CVE that names Eventin among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Eventin < 4.1.24 - Unauthenticated Payment Bypass via Stripe and PayPal Cross-Order Transaction Replay
- Eventin
- CWE-345
- CVSS 3.7 Low
Eventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint
- Eventin
- Broken access control
- CVSS 2.7 Low
Eventin < 4.1.24 - Contributor+ User Creation via Speaker Creation
- Eventin
- Broken access control
- CVSS 5.3 Medium
Eventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token
- Eventin
- Broken access control
- CVSS 4.9 Medium
Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization
- Eventin
- Broken access control
- CVSS 6.6 Medium
Eventin < 4.1.21 - Contributor+ LFI via Event Layout Meta
- Eventin
- Path traversal
- CVSS 5.3 Medium
Eventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token
- Eventin
- Broken access control
- CVSS 5.3 Medium
Eventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure
- Eventin
- Broken access control
- CVSS 2.7 Low
Eventin < 4.1.21 - Contributor+ Server-Side Request Forgery
- Eventin
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR
- Eventin
- Broken access control
- CVSS 7.2 High
Eventin < 4.1.21 - Contributor+ Speaker Account Deletion via IDOR
- Eventin
- Broken access control
- CVSS 2.7 Low
Eventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation
- Eventin
- Broken access control
- CVSS 8.1 High
Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR
- Eventin
- Broken access control
- CVSS 4.3 Medium
Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR
- Eventin
- Broken access control
- CVSS 8.2 High
Eventin < 4.1.20 - Unauthenticated Account Creation via Waiting List Endpoint
- Eventin
- Broken access control
- CVSS 6.5 Medium
Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API
- Eventin
- Information disclosure
- CVSS 7.2 High
Eventin < 4.1.20 - Editor+ Local File Inclusion via speaker_template Setting
- Eventin
- Path traversal
- CVSS 7.5 High
Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation
- Eventin
- Broken access control