6 matches found
CVE-2026-55190
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...
CVE-2026-55190
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...
CVE-2026-55190 Event Schedule Vulnerable to SSRF: isUrlSafe() bypassable via bracketed IPv6 literals (parse_url keeps the brackets so the IPv6 guard never matches) and a v4-only-resolver fail-open; reaches internal/localhost services on event import
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...
EUVD-2026-108748
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when th...
PT-2026-121942
Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, AppUtilsUrlUtils::isUrlSafe is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reaching internal/localhost services when the...
Event Schedule server-side request forgery vulnerability
Versions 1.0.0 and earlier of Event Schedule contain a server-side request forgery vulnerability. This vulnerability arises because the SSRF protection implemented in App\Utils\UrlUtils::isUrlSafe for user-supplied import URLs can be bypassed. When these URLs are retrieved by ImportCuratorEvents,...