Vulnerabilities

Any user logged in to a vFairs 3.3 virtual conference or event can perform SQL injection with a malicious query to the API.

In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload.

vFairs 3.3 is affected by Insecure Permissions.

vFairs 3.3 is affected by Remote Code Execution.