Cyber Resilience

CVE-2026-34455

HighPublic PoC

Published: 01 April 2026

Published
01 April 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0035 26.8th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-34455 is a high-severity SQL Injection (CWE-89) vulnerability in Hi.Events Hi.Events. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-34455 is a SQL injection vulnerability (CWE-89) affecting Hi.Events, an open-source event management and ticket selling platform built with Laravel. The flaw impacts versions from 0.8.0-beta.1 up to but not including 1.7.1-beta, where multiple repository classes pass the user-supplied "sort_by" query parameter directly to Eloquent's orderBy() method without validation. This enables injection of arbitrary SQL code. Hi.Events uses PostgreSQL as its database, which supports stacked queries, amplifying the potential impact.

With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability is exploitable over the network with low complexity by low-privileged authenticated users, requiring no user interaction. Attackers can inject and execute malicious SQL via the sort_by parameter, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized data access, modification, or deletion through stacked queries.

The vulnerability has been addressed in version 1.7.1-beta. Mitigation involves upgrading to this patched release. Key resources include the fixing commit (https://github.com/HiEventsDev/Hi.Events/commit/01e1aee28d7249f235fdcca8e3a34e88214dcde9), pull request (https://github.com/HiEventsDev/Hi.Events/pull/1128), release tag (https://github.com/HiEventsDev/Hi.Events/releases/tag/v1.7.1-beta), and GitHub security advisory (https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2qcp-24fh-fx6p).

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection. The application uses PostgreSQL which…

more

supports stacked queries. This issue has been patched in version 1.7.1-beta.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

SQL injection vulnerability in a web application (Hi.Events) directly enables exploitation of public-facing applications over the network.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24956Shared CWE-89
CVE-2026-33615Shared CWE-89
CVE-2025-28939Shared CWE-89
CVE-2021-47872Shared CWE-89
CVE-2025-28873Shared CWE-89
CVE-2019-25636Shared CWE-89
CVE-2026-32611Shared CWE-89
CVE-2026-42755Shared CWE-89
CVE-2024-53544Shared CWE-89
CVE-2026-21410Shared CWE-89

Affected Assets

hi.events
hi.events
0.8.0 — 1.7.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of user-supplied inputs like the sort_by parameter before passing to database queries, preventing SQL injection.

prevent

Mandates timely identification, reporting, and correction of flaws such as this SQL injection vulnerability through patching to version 1.7.1-beta.

prevent

Enforces restrictions on information inputs at system boundaries to limit malicious SQL payloads in parameters like sort_by.

References