alfio-event vulnerabilities

CVEs per yearBy the year they were published

1. 20235
2. 20246
3. 20263

Newest CVEs

• CVE-2026-50165

  alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

  alfio-event · alf.io

  High7.1
• CVE-2026-41412

  alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script

  alfio-event · alf.io

  Medium4.9
• CVE-2026-35482

  alf.io has an Authenticated RCE via Extension Script Sandbox Escape

  alfio-event · alf.io

  High8.0
• CVE-2024-45300

  Bypassing promo code limitations with race conditions

  alfio-event · alf.io

  High7.5
• CVE-2024-45299

  alf.io's preloaded data as json is not escaped correctly

  alfio-event · alf.io

  Medium6.5
• CVE-2024-25634

  IDOR make user can read e-mail log sent by other events

  alfio-event · alf.io

  High7.2
• CVE-2024-25635

  IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS

  alfio-event · alf.io

  High8.8
• CVE-2024-25627

  Cross-Site Scripting (XSS) via File Upload in Alf.io

  alfio-event · alf.io

  Low3.5
• CVE-2024-25628

  Insufficient Session Expiration in alf.io

  alfio-event · alf.io

  High7.6
• CVE-2023-2260

  Authorization Bypass Through User-Controlled Key in alfio-event/alf.io

  alfio-event · alfio-event/alf.io

  High8.8