Skip to content
OpenAdvisories

Vendor

HiEventsDev

6 known vulnerabilities.

HiEventsDev at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 0 vulnerabilities June 2026: 2 vulnerabilities Jun July 2026: 2 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202610
Jul 202620
Jun 202620
May 202600
Apr 202610
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Hi.Events 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 8.5
    CVE-2026-76838

    Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

    Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any …

    HiEventsDev Hi.Events
  • Medium 5.4
    CVE-2026-60119

    Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection

    Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, w…

    HiEventsDev Hi.Events
  • Medium 5.3
    CVE-2026-60118

    Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint

    Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. A…

    HiEventsDev Hi.Events
  • Medium 6.5
    CVE-2026-57960

    Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id

    Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/p…

    HiEventsDev Hi.Events
  • Medium 5.9
    CVE-2026-57959

    Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition

    Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequenti…

    HiEventsDev Hi.Events
  • High 8.7
    CVE-2026-34455

    Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository Classes

    Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, e…

    HiEventsDev Hi.Events