Franky vulnerabilities and threats

CVE-2026-124255 is a medium severity vulnerability in Franky Events Made Easy (versions before 3.3.6) involving improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue. This flaw allows code injection via crafted input. The vulnerability is fixed in version 3.3.6.

CVE-2026-28162 is a high severity vulnerability in Franky's Events Made Easy software versions up to and including 3.2.5. It is an unauthenticated cross-site scripting (XSS) flaw that involves improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can affect confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance is currently available from the vendor.

Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.