Skip to content
OpenAdvisories

Vendor

HiEventsDev

6 known vulnerabilities.

Products

Hi.Events 6
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-60119

    Hi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection

    Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arbitrary HTML and JavaScript by embedding a malicious event title containing the </script> sequence, w…

    HiEventsDev Hi.Events
  • Medium 5.3
    CVE-2026-60118

    Hi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint

    Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by referencing hidden product and price IDs in order creation requests without authorization checks. A…

    HiEventsDev Hi.Events
  • Medium 6.5
    CVE-2026-57960

    Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via Check-in List short_id

    Hi.Events through 1.9.0 public check-in list endpoints use short_id as sole access control, allowing unauthenticated access to retrieve full attendee lists including emails and personal information. Attackers with knowledge of the short_id can call GET /api/p…

    HiEventsDev Hi.Events
  • Medium 5.9
    CVE-2026-57959

    Hi.Events 1.9.0 - Promo Code Max-Usage Bypass via Asynchronous Job Race Condition

    Hi.Events through 1.9.0 contains a promo code validation vulnerability where reservation validates usage count before asynchronous UpdateEventStatisticsJob increments it, allowing attackers to redeem limited promo codes unlimited times. Attackers can sequenti…

    HiEventsDev Hi.Events