CVE-2017-1002026

Name of the Vulnerable Software and Affected Versions Event Expresso Free version 3.1.37.11.L

Description The issue concerns a lack of input sanitization in the edit event category function, which passes user-supplied input via the $id parameter into an SQL statement without proper validation.

Recommendations For Event Expresso Free version 3.1.37.11.L, consider disabling the edit event category function until a patch is available to prevent potential SQL injection attacks. Restrict access to the $id parameter in the affected function to minimize the risk of exploitation.