Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Sep 9, 2026alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.CVE-2026-50165 · Other software · alfio-event · reported by GitHubHigh 7.1
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuration" endpoints. The affected endpoints require organization or event ownership, but they accept an arbitrary configuration key and then return the first matching value from a lookup that includes system-level configuration. As a result, an organization owner can retrieve secrets intended to be administrator-only, including the system API key when it is configured. Version 2.0-M5-2605 fixes the issue.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.CVE-2026-41412 · Other software · alfio-event · reported by GitHubMedium 4.9
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a fully-functional HTTP client (`simpleHttpClient`) into every extension script's scope. The `postFileAndSaveResponse()` method accepts an arbitrary filesystem path as its `file` parameter and reads the file contents using `new FileInputStream(file)` with no path validation, directory restriction, or allowlist. A malicious extension script can read any file accessible to the JVM process user and exfiltrate it to an attacker-controlled server via HTTP POST. Version 2.0-M5-2606 patches the issue.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2026alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.CVE-2026-35482 · Other software · alfio-event · reported by GitHubHigh 8
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an authenticated administrator to execute arbitrary operating system commands on the server. The extension system is intended to execute restricted JavaScript in a sandboxed Rhino environment; however, a combination of an unguarded injected Java object (`returnClass`) and an incomplete AST blocklist allows the sandbox to be fully escaped using Java reflection without triggering any validation errors. Version 2.0-M5-2606 patches the issue.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2024alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.CVE-2024-45300 · Other software · alfio-event · reported by GitHubHigh 7.5
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 6, 2024alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.CVE-2024-45299 · Other software · alfio-event · reported by GitHubMedium 6.5
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The Content-Security-Policy directive blocks any potential script execution. The administrator or event administrator can override the texts for customization purpose. The texts are not properly escaped. Version 2.0-M5 fixes this issue.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024alf.io is an open source ticket reservation system.CVE-2024-25635 · Other software · alfio-event · reported by GitHubHigh 8.8
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, organization owners can view the generated API KEY and USERS of other organization owners using the `http://192.168.26.128:8080/admin/api/users/<user_id>` endpoint, which exposes the details of the provided user ID. This may also expose the API KEY in the username of the user. Version 2.0-M4-2402 fixes this issue.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2024alf.io is an open source ticket reservation system.CVE-2024-25634 · Other software · alfio-event · reported by GitHubHigh 7.2
alf.io is an open source ticket reservation system. Prior to version 2.0-Mr-2402, an attacker can access data from other organizers. The attacker can use a specially crafted request to receive the e-mail log sent by other events. Version 2.0-M4-2402 fixes this issue.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2024Alf.io is a free and open source event attendance management system.CVE-2024-25628 · Other software · alfio-event · reported by GitHubHigh 7.6
Alf.io is a free and open source event attendance management system. In versions prior to 2.0-M4-2402 users can access the admin area even after being invalidated/deleted. This issue has been addressed in version 2.0-M4-2402. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2024Alf.io is a free and open source event attendance management system.CVE-2024-25627 · Other software · alfio-event · reported by GitHubLow 3.5
Alf.io is a free and open source event attendance management system. An administrator on the alf.io application is able to upload HTML files that trigger JavaScript payloads. As such, an attacker gaining administrative access to the alf.io application may be able to persist access by planting an XSS payload. This issue has been addressed in version 2.0-M4-2402. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-2260 · Other software · alfio-event · reported by security@huntr.devHigh 8.8
Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-2259 · Other software · alfio-event · reported by security@huntr.devHigh 7.2
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2023Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.CVE-2023-2258 · Other software · alfio-event · reported by security@huntr.devHigh 8.8
Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.CVE-2023-0301 · Other software · alfio-event · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301.CVE-2023-0300 · Other software · alfio-event · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301.
- Product
- alfio-event/alf.io
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.