---
id: "CVE-2026-112142"
kind: "vulnerability"
aliases: ["CVE-2026-112142"]
title: "Events-Management-System: SQL injection in registration delete handler lets attackers read or alter data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["events-management", "package", "php", "self-hosted"]
not_affected_if: ["dodelete-not-reachable", "not-deployed"]
published_at: "2026-10-19T13:16:57+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:23:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112142", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Events-Management-System: SQL injection in registration delete handler lets attackers read or alter data

The satya-vinay Events-Management-System has an SQL injection in its dodelete.php registration-delete handler, where the ID argument is not sanitized. A remote attacker can manipulate the database query to read or change stored data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application runs satya-vinay Events-Management-System code by looking for dodelete.php in the deployed tree
- Confirm the deployed commit against `437c77ceb69bf9fe2e3f4f46f7871b83f425383a`; unknown whether that commit is the last affected one

## Fix

- unknown: no fixed version or patch is named by the sources; the project has not responded to the report
- Restrict access to dodelete.php or remove the file until a fix is available

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112142

## From the sources

A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Delete Handler. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_