CVE-2026-34455
Published: 01 April 2026
Summary
CVE-2026-34455 is a high-severity SQL Injection (CWE-89) vulnerability in Hi.Events Hi.Events. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-34455 is a SQL injection vulnerability (CWE-89) affecting Hi.Events, an open-source event management and ticket selling platform built with Laravel. The flaw impacts versions from 0.8.0-beta.1 up to but not including 1.7.1-beta, where multiple repository classes pass the user-supplied "sort_by" query parameter directly to Eloquent's orderBy() method without validation. This enables injection of arbitrary SQL code. Hi.Events uses PostgreSQL as its database, which supports stacked queries, amplifying the potential impact.
With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network with low complexity by low-privileged authenticated users, requiring no user interaction. Attackers can inject and execute malicious SQL via the sort_by parameter, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized data access, modification, or deletion through stacked queries.
The vulnerability has been addressed in version 1.7.1-beta. Mitigation involves upgrading to this patched release. Key resources include the fixing commit (https://github.com/HiEventsDev/Hi.Events/commit/01e1aee28d7249f235fdcca8e3a34e88214dcde9), pull request (https://github.com/HiEventsDev/Hi.Events/pull/1128), release tag (https://github.com/HiEventsDev/Hi.Events/releases/tag/v1.7.1-beta), and GitHub security advisory (https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2qcp-24fh-fx6p).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18007
Vulnerability details
Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection. The application uses PostgreSQL which…
more
supports stacked queries. This issue has been patched in version 1.7.1-beta.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection vulnerability in a web application (Hi.Events) directly enables exploitation of public-facing applications over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of user-supplied inputs like the sort_by parameter before passing to database queries, preventing SQL injection.
Mandates timely identification, reporting, and correction of flaws such as this SQL injection vulnerability through patching to version 1.7.1-beta.
Enforces restrictions on information inputs at system boundaries to limit malicious SQL payloads in parameters like sort_by.