CVE-2026-15448

Name of the Vulnerable Software and Affected Versions Tickera – Sell Tickets & Manage Events versions prior to 3.6.0.2

Description An issue exists where authenticated attackers with staff-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of the user-supplied parameter tc order status filter and a lack of sufficient preparation on the existing SQL query, allowing the addition of malicious SQL queries to extract sensitive information from the database.

Recommendations Update Tickera – Sell Tickets & Manage Events to version 3.6.0.2 or later. Avoid using the tc order status filter parameter until the update is applied.