Vulnerabilities

TI-2026-36928 CVE-2026-50165

alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

LOW 31

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00351 Published 2026-09-09 Fixed in 2.0-M5-2606 CWE-284

TI-2026-30012 CVE-2026-41412

alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script

MEDIUM 56

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00317 Published 2026-06-02 Fixed in 2.0-M5-2606 CWE-22

TI-2026-27611 CVE-2026-35482

alf.io has an Authenticated RCE via Extension Script Sandbox Escape

HIGH 74

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00282 Published 2026-06-02 Fixed in 2.0-M5-2606 CWE-863

TI-2024-30371 CVE-2024-45300

Bypassing promo code limitations with race conditions

HIGH 72

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0042 Published 2024-09-06 Fixed in 2.0-M5 CWE-362

TI-2024-30370 CVE-2024-45299

alf.io's preloaded data as json is not escaped correctly

MEDIUM 62

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00716 Published 2024-09-06 Fixed in 2.0-M5 CWE-116

TI-2024-16862 CVE-2024-25634

IDOR make user can read e-mail log sent by other events

HIGH 67

alf.io is an open source ticket reservation system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00748 Published 2024-02-19 Fixed in 2.0-M4-2402 CWE-497

TI-2024-16863 CVE-2024-25635

IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS

HIGH 73

alf.io is an open source ticket reservation system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00716 Published 2024-02-19 Fixed in 2.0-M4-2402 CWE-612

TI-2024-16855 CVE-2024-25627

Cross-Site Scripting (XSS) via File Upload in Alf.io

MEDIUM 55

Alf.io is a free and open source event attendance management system.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.0043 Published 2024-02-16 Fixed in 2.0-M4-2304 CWE-434

TI-2024-16856 CVE-2024-25628

Insufficient Session Expiration in alf.io

LOW 35

Alf.io is a free and open source event attendance management system.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00379 Published 2024-02-16 Fixed in 2.0-M4-2402 CWE-613

TI-2023-02119 CVE-2023-2260 · GHSA-2rcc-q9cg-9v38

Authorization Bypass Through User-Controlled Key in alfio-event/alf.io

MEDIUM 42

Authorization Bypass Through User-Controlled Key in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00859 Published 2023-04-24 Fixed in 2.0-M4-2304 CWE-639

TI-2023-02118 CVE-2023-2259 · GHSA-4w64-j7cg-53xc

Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io

HIGH 67

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01089 Published 2023-04-24 Fixed in 2.0-M4-2304 CWE-1336

TI-2023-02117 CVE-2023-2258 · GHSA-7rc3-9hxj-g7h2

Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io

MEDIUM 42

Improper Neutralization of Formula Elements in a CSV File in GitHub repository alfio-event/alf.io prior to 2.0-M4-2304.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00913 Published 2023-04-24 Fixed in 2.0-M4-2304 CWE-1236

TI-2023-00286 CVE-2023-0301 · GHSA-rh8m-jh32-vpcr

Cross-site Scripting (XSS) - Stored in alfio-event/alf.io

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository alfio-event/alf.io prior to Alf.io 2.0-M4-2301.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00495 Published 2023-01-14 Fixed in Alf.io 2.0-M4-2301 CWE-79

TI-2023-00285 CVE-2023-0300 · GHSA-gr7w-282r-wq4h

Cross-site Scripting (XSS) - Reflected in alfio-event/alf.io

MEDIUM 58

Cross-site Scripting (XSS) - Reflected in GitHub repository alfio-event/alf.io prior to 2.0-M4-2301.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00508 Published 2023-01-14 Fixed in 2.0-M4-2301 CWE-79

Vulnerabilities

Filters