Skip to content
OpenAdvisories

Vendor

HiEventsDev

6 known vulnerabilities.

Products

Hi.Events 6
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.5
    CVE-2026-76838

    Hi.Events before 1.11.1-beta Server-Side Request Forgery via Unvalidated Webhook Redirects

    Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any …

    HiEventsDev Hi.Events
  • High 8.7
    CVE-2026-34455

    Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository Classes

    Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, e…

    HiEventsDev Hi.Events