CVE-2026-112144
Deferred Deferred - Pending Action

Path Traversal in satya-vinay Events-Management-System

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessible. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112144
EUVD
EUVD-2026-104322

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
satya-vinay Events-Management-System 437c77ceb69bf9fe2e3f4f46f7871b83f425383a

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-425 The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves an exposure of sensitive data in the satya-vinay Events-Management-System. Two SQL dump files, project.sql and symbols.sql, contain personal information including real names and email addresses of individuals. This data is publicly accessible due to being part of the git history, meaning it remains available even if files are deleted from the current version.

Detection Guidance

Check if the Events-Management-System repository or its SQL dump files (project.sql, symbols.sql) are publicly accessible. Inspect git history for exposed sensitive data like personal emails or registration details. Use commands like 'git log -- project.sql' or 'git show project.sql' to review file history.

Impact Analysis

The exposure of personal data can lead to risks such as spam, phishing, social engineering attacks, and unwanted contact. Since the data is embedded in git history, it is difficult to fully remove, and copies may persist in forks or mirrors of the repository.

Compliance Impact

The vulnerability exposes personal data (real names and email addresses) in public git history, violating GDPR principles of data minimization and security. It also risks unauthorized access, which could lead to breaches of confidentiality required under HIPAA for protected health information.

Mitigation Strategies

Remove sensitive data from the repository and rewrite git history using 'git filter-branch' or tools like BFG Repo-Cleaner. Notify users to change exposed personal information. Consider revoking compromised credentials if present. Monitor for misuse of exposed data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart