{"id":"CVE-2026-112142","kind":"vulnerability","aliases":["CVE-2026-112142"],"related":[],"title":"Events-Management-System: SQL injection in registration delete handler lets attackers read or alter data","description":"A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The satya-vinay Events-Management-System has an SQL injection in its dodelete.php registration-delete handler, where the ID argument is not sanitized. A remote attacker can manipulate the database query to read or change stored data.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["events-management","package","php","self-hosted"],"not_affected_if":["dodelete-not-reachable","not-deployed"],"how_to_check":"- Check whether the application runs satya-vinay Events-Management-System code by looking for dodelete.php in the deployed tree\n- Confirm the deployed commit against `437c77ceb69bf9fe2e3f4f46f7871b83f425383a`; unknown whether that commit is the last affected one","fix":"- unknown: no fixed version or patch is named by the sources; the project has not responded to the report\n- Restrict access to dodelete.php or remove the file until a fix is available","status":"open","published_at":"2026-10-19T13:16:57+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:23:06+00:00","updated_at":"2026-10-25T03:23:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:23:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: no fixed version or patch is named by the sources; the project has not responded to the report\n- Restrict access to dodelete.php or remove the file until a fix is available","reach":"internet","title":"Events-Management-System: SQL injection in registration delete handler lets attackers read or alter data","impact":"high","summary":"The satya-vinay Events-Management-System has an SQL injection in its dodelete.php registration-delete handler, where the ID argument is not sanitized. A remote attacker can manipulate the database query to read or change stored data.","category":"package","nicknames":[],"who_cares":["php","self-hosted","events-management"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs SQL queries against the application database remotely","analyst_note":"Confirm whether dodelete.php requires authentication and whether a fixed commit exists; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112142.","how_to_check":"- Check whether the application runs satya-vinay Events-Management-System code by looking for dodelete.php in the deployed tree\n- Confirm the deployed commit against `437c77ceb69bf9fe2e3f4f46f7871b83f425383a`; unknown whether that commit is the last affected one","needs_analyst":true,"not_affected_if":["not-deployed","dodelete-not-reachable"],"who_is_affected":"Teams that deploy the satya-vinay Events-Management-System from its repository, since it is a rolling release with no version numbers. Exposure depends on whether dodelete.php is reachable from the internet. Teams not running this project can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3433,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112142':19A,22A '-2026':18A,21A '437c77ceb69bf9fe2e3f4f46f7871b83f425383a':85C 'affect':86C,144C 'alter':15A 'argument':53B,109C 'attack':12A,59B,116C 'avail':125C 'chang':68B 'compon':100C 'cve':17A,20A 'data':16A,70B 'databas':63B 'delet':9A,48B,103C 'deliveri':138C 'dodelete.php':45B,97C 'earli':157C 'event':2A,24B,36B,80C 'events-manag':23B 'events-management-system':1A,35B,79C 'execut':119C 'exploit':122C 'file':96C 'function':93C 'handler':10A,49B,104C 'host':30B 'id':52B,110C 'identifi':74C 'implement':132C 'inform':142C,153C 'inject':6A,42B,114C 'issu':160C 'lead':111C 'let':11A 'manag':3A,25B,37B,81C 'manipul':61B,106C 'mean':140C 'might':127C 'ongo':137C 'packag':26B 'php':27B 'problem':156C 'product':131C 'project':151C 'public':124C 'queri':64B 'read':13A,66B 'registr':8A,47B,102C 'registration-delet':46B,101C 'releas':135C,147C 'remot':58B,120C 'report':161C 'respond':165C 'roll':134C 'sanit':56B 'satya':33B,77C 'satya-vinay':32B,76C 'self':29B 'self-host':28B 'sql':5A,41B,113C 'store':69B 'system':4A,38B,82C 'unavail':149C 'unknown':92C 'updat':146C 'use':129C 'version':141C 'vinay':34B,78C 'vulner':72C,89C 'yet':166C","nicknames":[],"mitigations":[],"who_affected":"Teams that deploy the satya-vinay Events-Management-System from its repository, since it is a rolling release with no version numbers. Exposure depends on whether dodelete.php is reachable from the internet. Teams not running this project can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T13:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112142","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112142","severity":null,"published_at":"2026-10-19T13:16:57+00:00","modified_at":"2026-10-19T19:17:25+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}