CVE-2026-34455
- Source
- https://cve.org/CVERecord?id=CVE-2026-34455
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34455.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-34455
- Aliases
-
- GHSA-2qcp-24fh-fx6p
- Published
- 2026-04-01T19:56:34Z
- Modified
- 2026-10-28T02:30:31Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Hi.Events: SQL Injection via Unvalidated sort_by Query Parameter in Multiple Repository Classes
- Details
-
Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection. The application uses PostgreSQL which supports stacked queries. This issue has been patched in version 1.7.1-beta.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-89" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34455.json" }- References
-
- https://github.com/HiEventsDev/Hi.Events/releases/tag/v1.7.1-beta
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34455.json
- https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2qcp-24fh-fx6p
- https://nvd.nist.gov/vuln/detail/CVE-2026-34455
- https://github.com/HiEventsDev/Hi.Events/commit/01e1aee28d7249f235fdcca8e3a34e88214dcde9
- https://github.com/HiEventsDev/Hi.Events/pull/1128
Affected packages
Git / github.com/hieventsdev/hi.events
Affected ranges
- Type
- GIT
- Repo
- https://github.com/hieventsdev/hi.events
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.8.0-beta.1" }, { "fixed": "1.7.1-beta" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "01e1aee28d7249f235fdcca8e3a34e88214dcde9" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.7.1-beta", "range": [ { "fixed": "8a5c9d23775a50878c2a37cfa3724f31acbd7a21" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
v0.*
v0.8.0-beta.1
v0.8.0-beta.2
v0.8.0-beta.3
v0.8.0-beta.4
v0.8.0-beta.5
v0.8.0-beta.6
v0.8.0-beta.7
v0.8.0-beta.8
v0.8.0-beta.9
v1.*
v1.0.0-alpha.10
v1.0.0-alpha.11
v1.0.0-alpha.12
v1.0.0-alpha.13
v1.0.0-alpha.14
v1.0.0-alpha.15
v1.0.0-alpha.16
v1.0.0-alpha.17
v1.0.0-alpha.5
v1.0.0-alpha.6
v1.0.0-alpha.7
v1.0.0-alpha.8
v1.0.0-alpha.9
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.1.0-alpha.1
v1.1.0-alpha.2
v1.1.0-beta.1
v1.1.0-beta.2
v1.2.0-beta.1
v1.3.0-beta.1
v1.4.0-beta.1
v1.5.0-beta.1
v1.5.1-beta.1
v1.6.0-beta.1
v1.7.0-beta