CyberSecBulletin

HiEventsDev vulnerabilities

We track 2 vulnerabilities in HiEventsDev products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 24, 2026.

2vulnerabilities
0critical
2high
0exploited
8.7average CVSS score

Latest HiEventsDev vulnerabilities

  • 8.5 High severity

    Hi.Events: Server-Side Request Forgery

    CVE-2026-76838HiEventsDev

    Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any p

  • 8.8 High severity

    Hi.Events: Improper Neutralization of Special Elements used in an SQL Command

    CVE-2026-34455HiEventsDev

    Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, en