Advisories · Technology
Events Manager.
Every CVE that names Events Manager among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
Events Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter
- Events Manager
- Information disclosure
- CVSS 2.7 Low
Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR
- Events Manager
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Events Manager < 7.4.1 - Unauthenticated Privilege Escalation to Administrator
- Events Manager
- Privilege escalation
- CVSS 8.1 High
Events Manager < 7.4.1 - Subscriber+ Booking Consent Record Tampering via SQL Injection
- Events Manager
- SQL injection
- CVSS 7.5 High
Events Manager < 7.4 - Unauthenticated Pending Upload Disclosure via events-manager/v1/uploads
- Events Manager
- Information disclosure
- CVSS 7.5 High
Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration
- Events Manager
- SQL injection
-
Events Manager < 5.9.8 - Cross-Site Scripting (XSS)
- Events Manager
- Cross-site scripting (XSS)
-
Events Manager < 5.9.8 - Admin+ SQL Injection
- Events Manager
- SQL injection