Advisories · Technology

HiEventsDev Hi.Events.

Every CVE that names HiEventsDev Hi.Events among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-76838 CVE record

CVSS 8.4 High

Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects
- HiEventsDev Hi.Events
- Server-side request forgery (SSRF)
Not analysed yet 24 Aug 2026
CVE-2026-60119 CVE record

CVSS 5.1 Medium

Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection
- HiEventsDev Hi.Events
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-60118 CVE record

CVSS 6.9 Medium

Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint
- HiEventsDev Hi.Events
- Broken access control
Not analysed yet 14 Jul 2026
CVE-2026-57960 CVE record

CVSS 8.3 High

Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id
- HiEventsDev Hi.Events
- Information disclosure
Not analysed yet 29 Jun 2026
CVE-2026-57959 CVE record

CVSS 8.2 High

Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition
- HiEventsDev Hi.Events
- Race condition
Not analysed yet 29 Jun 2026
CVE-2026-34455 CVE record

CVSS 8.7 High

Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository Classes
- HiEventsDev Hi.Events
- SQL injection
Not analysed yet 1 Apr 2026