Hi.Events vulnerabilities

2 known vulnerabilities in Hi.Events from HiEventsDev. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.5 High severity

  Hi.Events: Server-Side Request Forgery

  CVE-2026-76838Aug 24, 2026HiEventsDev

  Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule in backend/app/Validators/Rules/NoInternalUrlRule.php resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any p

• 8.8 High severity

  Hi.Events: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-34455Apr 1, 2026HiEventsDev

  Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, en