CVE-2026-112141: SQL Injection in satya-vinay Events-Management-System

The satya-vinay Events-Management-System up to commit 437c77ceb69bf9fe2e3f4f46f7871b83f425383a contains an SQL injection vulnerability in the doedit.php file within the Registration-Edit Handler component. The vulnerability is due to improper sanitization of input parameters (id, name, title, year, gender, fromdate, todate, people) passed to the mysqli_query function, enabling remote attackers to inject and execute arbitrary SQL queries. The product follows a rolling release approach, and no specific version information is provided. The vulnerability has been publicly disclosed with exploit code available, but the vendor has not yet responded or issued a fix.

Successful exploitation allows remote attackers to perform SQL injection attacks, potentially leading to unauthorized data access or modification within the Events-Management-System database. The CVSS 4.0 base score is 6.9 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts. No known active exploitation in the wild has been reported yet.

No official fix or patch has been provided by the vendor as of the latest information. Since the product uses a rolling release model and the vendor has not responded, users should monitor the vendor's channels for updates. Until a fix is available, restricting access to the vulnerable component and implementing web application firewall (WAF) rules to detect and block SQL injection attempts may help mitigate risk.