CVE-2026-105889

Summary

This vulnerability allows attackers to perform blind SQL injection attacks against the Tickera event ticketing system, potentially enabling unauthorized access to sensitive database information without authentication. The flaw occurs when user input is not properly sanitized before being used in SQL queries.

Exploitability

Exploitation requires no authentication and can be performed remotely with minimal preconditions, making it highly practical for attackers to leverage.

Blast radius

If exploited, this vulnerability could lead to unauthorized access to all event data, user information, and potentially sensitive financial records stored in the database.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 3.6.0.7 or later to remediate this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.