CVE-2026-121858

{
  "etk_id": "ETK-2026-3806",
  "cve_id": "CVE-2026-121858",
  "display_id": "CVE-2026-121858",
  "ghsa_id": "GHSA-63f4-qh3h-4mx3",
  "euvd_id": "EUVD-2026-118948",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Event Tickets with Ticket Scanner",
  "summary": "Event Tickets with Ticket Scanner releases before 3.2.9 are affected by SQL injection in search handling on administrative listing pages. An attacker who can access the plugin's admin interface may alter database queries through those searches.",
  "mitigation": "Upgrade Event Tickets with Ticket Scanner to version 3.2.9 or later. Restrict access to the plugin's administrative pages to trusted roles until the update is installed.",
  "vendor": null,
  "product": "Event Tickets with Ticket Scanner",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 3.2.9"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "3.2.9"
      ],
      "package_name": "Event Tickets with Ticket Scanner",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 6.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 18.160369,
  "t0_at": "2026-11-07T06:00:29.004000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-07T08:00:36.822469+00:00",
      "days": 0.08342382487268518,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:29.004000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-07T06:00:29.004000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-07T06:00:29.004000+00:00",
      "url": "https://github.com/advisories/GHSA-63f4-qh3h-4mx3"
    }
  }
}