PT-2026-29592

CVE-2026-34455

Published

2026-04-01

Updated

2026-04-02

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hi.Events versions 0.8.0-beta.1 through 1.7.1-beta

Description Hi.Events is an open-source event management and ticket selling platform. Multiple repository classes pass the user-supplied sort by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection. The application uses PostgreSQL which supports stacked queries.

Recommendations Update to version 1.7.1-beta or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Tikket1

Vendors

Affected products

Weakness enumeration

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers