CVE-2026-112143
Deferred Deferred - Pending Action

Authentication Bypass in satya-vinay Events-Management-System

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this issue is some unknown functionality. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112143
EUVD
EUVD-2026-104328

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication flaw in the satya-vinay Events-Management-System. The application does not require any login or session checks, allowing anyone to access sensitive pages like edit.php, delete.php, and report.php without restrictions. Attackers can retrieve, modify, or delete registrant data by sending direct requests to vulnerable endpoints. The system lacks any authentication mechanisms entirely.

Detection Guidance

Check if the Events-Management-System endpoints like edit.php, delete.php, report.php, dodelete.php, and doedit.php are publicly accessible without authentication. Use curl to access these pages directly and verify if they return HTTP 200 without requiring login. Example: curl -I http://target/edit.php

Search the codebase for authentication-related terms like session, login, or user management. If none are found, the system lacks authentication entirely.

Impact Analysis

If you use this system, attackers can access all registrant data, including email addresses, without authentication. They can also delete or edit records arbitrarily. Since the exploit is public, anyone on the internet can perform these actions, leading to data breaches, unauthorized modifications, and loss of data integrity.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized data access and exposure. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. The lack of authentication means the system fails to meet these compliance requirements, risking legal penalties and data protection violations.

Mitigation Strategies

Immediately restrict access to the application by deploying a web application firewall or network-level controls to block unauthorized access until authentication is implemented.

Add a robust authentication and authorization layer, including user management, login mechanisms, and session handling. This requires a complete redesign of the application's access control.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112143. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart