CVE-2026-34455 Details
Description
Hi.Events is an open-source event management and ticket selling platform. From version 0.8.0-beta.1 to before version 1.7.1-beta, multiple repository classes pass the user-supplied sort_by query parameter directly to Eloquent's orderBy() without validation, enabling SQL injection. The application uses PostgreSQL which supports stacked queries. This issue has been patched in version 1.7.1-beta.
A SQL injection vulnerability has been identified in Hi.Events, an open-source event management platform, affecting versions 0.8.0-beta.1 prior to 1.7.1-beta. Multiple repository classes improperly validate the user-supplied sort_by query parameter before passing it to Eloquent's orderBy() method. This oversight allows for SQL injection, particularly in the PostgreSQL environment used by the application, which supports stacked queries. The vulnerability has been patched in version 1.7.1-beta.
The vulnerability has been addressed in version 1.7.1-beta. Users should update to this version. For those maintaining their own versions, apply the same validation pattern used in the admin endpoint to all repository classes that handle the sort_by parameter.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2qcp-24fh-fx6p | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/HiEventsDev/Hi.Events/commit/01e1aee28d7249f235fdcca8e3a34e88214dcde9 | [email protected] | Patch |
| https://github.com/HiEventsDev/Hi.Events/pull/1128 | [email protected] | Issue TrackingPatch |
| https://github.com/HiEventsDev/Hi.Events/releases/tag/v1.7.1-beta | [email protected] | ProductRelease Notes |
| https://github.com/HiEventsDev/Hi.Events/security/advisories/GHSA-2qcp-24fh-fx6p | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hi.events hi.events | >= 0.8.0, < 1.7.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 15, 2026 | Initial Analysis | [email protected] |
| Apr 2, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | New CVE Received | [email protected] |