{"id":"CVE-2026-105889","published":"2026-10-10T17:17:00.063","lastModified":"2026-10-13T13:28:15.717","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tickera-event-ticketing-system/vulnerability/wordpress-tickera-plugin-3-6-0-6-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform blind SQL injection attacks against the Tickera event ticketing system, potentially enabling unauthorized access to sensitive database information without authentication. The flaw occurs when user input is not properly sanitized before being used in SQL queries.","exploitability":"Exploitation requires no authentication and can be performed remotely with minimal preconditions, making it highly practical for attackers to leverage.","blast_radius":"If exploited, this vulnerability could lead to unauthorized access to all event data, user information, and potentially sensitive financial records stored in the database.","remediation":"Upgrade to version 3.6.0.7 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","database","blind-sql"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:48:24.414Z"}}