CVE-2026-112142: satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attack can be executed remotely, and the vector indicates no privileges or user interaction are required. A publicly available exploit exists, which may lower the effort needed to attempt exploitation.
Which deployments should be considered affected?
Deployments of satya-vinay Events-Management-System containing the Registration-Delete Handler's dodelete.php file should be assessed, particularly revisions up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Because the project uses a rolling release, no affected or fixed version numbers are available.
How can defenders identify possible exposure?
Review dodelete.php in the Registration-Delete Handler and determine whether its ID argument can be influenced through remotely reachable requests. Also review web and application logs for suspicious requests targeting dodelete.php with anomalous ID values.
What is the likely impact if exploitation succeeds?
The supplied severity vector indicates low impacts to confidentiality, integrity, and availability. The underlying flaw is SQL injection through manipulation of the ID argument.