CVE-2026-93300

Name of the Vulnerable Software and Affected Versions EventON - Subscriber versions prior to 1.4.6

Description An unauthenticated attacker can perform a generic SQL Injection by appending additional SQL queries to existing ones. This is caused by insufficient escaping of user-supplied data and a lack of proper preparation of the SQL query. The issue occurs via the email parameter, allowing the extraction of sensitive information from the database.

Recommendations Update EventON - Subscriber to version 1.4.6 or later. Avoid using the email parameter in the affected plugin until the update is applied.