PT-2026-139189

CVE-2026-121858

Published

2026-11-05

Updated

2026-11-07

Description by

CVSS 3.1

6.3

Medium

MetricsAV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Event Tickets with Ticket Scanner versions prior to 3.2.9

Description Insufficient escaping of search values used in SQL queries within several admin listings allows authenticated users with administrative access to perform SQL injection attacks. This occurs due to a lack of sufficient preparation of the SQL query and improper handling of user-supplied parameters, enabling attackers to append additional queries to extract sensitive information from the database.

Recommendations Update to version 3.2.9 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Mokksh Parekh

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers