CVE-2026-15761

Name of the Vulnerable Software and Affected Versions Tickera – Sell Tickets & Manage Events versions prior to 3.6.0.2

Description An issue exists where authenticated attackers with staff-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of user-supplied input and a lack of proper preparation of the SQL query. Attackers can append additional SQL queries to extract sensitive information from the database. The flaw is reachable via the tc tickets instances admin list screen through the tc event filter parameter. Access to this path is granted by the add required capabilities() function to users with the custom Staff role via the edit tc tickets instances capability.

Recommendations Update to a version newer than 3.6.0.1. As a temporary mitigation, restrict access to the tc tickets instances admin list screen or avoid using the tc event filter parameter.