Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Unknown | Event Tickets with Ticket Scanner | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Sat, 07 Nov 2026 09:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-89 |
Sat, 07 Nov 2026 06:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Event Tickets with Ticket Scanner WordPress plugin before 3.2.9 does not properly escape a search value before using it in SQL queries in several of its admin listings, allowing users with access to its admin area (administrators by default, or any role granted access in its settings) to perform SQL injection attacks. | |
| Title | Event Tickets with Ticket Scanner < 3.2.9 - Authenticated SQLi via DataTables Search | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: WPScan
Published:
Updated: 2026-11-07T06:00:29.004Z
Reserved: 2026-11-04T09:23:13.992Z
Link: CVE-2026-121858
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-07T06:16:58.847
Modified: 2026-11-07T06:16:58.847
Link: CVE-2026-121858
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-07T08:45:05Z
-
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')