en
alfio-event is an open-source software project organization that develops alf.io, a ticket reservation and event attendance management system. Its software is intended for organizers of conferences, trade shows, workshops, meetups, and related events. The project is publicly maintained and includes associated tools for event check-in and badge scanning; the available evidence does not establish a larger commercial operating footprint.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScanAs of 09/20/2026, alfio-event recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, alf.io had the most security vulnerabilities in the alfio-event ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-50165alf.io has Improper Access Control for Organization Owners that Exposes System Secrets | Exploitation statusNot known exploited | FixNot confirmed | Affected productalf.io | Published09/09/2026 | SeverityHigh |
CVE-2026-41412alf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension Script | Exploitation statusPublic exploit | FixNot confirmed | Affected productalf.io | Published06/02/2026 | SeverityMedium |
CVE-2026-35482alf.io has an Authenticated RCE via Extension Script Sandbox Escape | Exploitation statusPublic exploit | FixNot confirmed | Affected productalf.io | Published06/02/2026 | SeverityHigh |
CVE-2024-45300Bypassing promo code limitations with race conditions | Exploitation statusPublic exploit | FixNot confirmed | Affected productalf.io | Published09/06/2024 | SeverityHigh |
CVE-2024-45299alf.io's preloaded data as json is not escaped correctly | Exploitation statusPublic exploit | FixNot confirmed | Affected productalf.io | Published09/06/2024 | SeverityMedium |
CVE-2024-25634IDOR make user can read e-mail log sent by other events | Exploitation statusPublic exploit | FixNot confirmed | Affected productalf.io | Published02/19/2024 | SeverityHigh |
CVE-2024-25635IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS | Exploitation statusPublic exploit | FixNot confirmed | Affected productalf.io | Published02/19/2024 | SeverityHigh |
CVE-2024-25627Cross-Site Scripting (XSS) via File Upload in Alf.io | Exploitation statusPublic exploit | FixNot confirmed | Affected productalf.io | Published02/16/2024 | SeverityLow |
CVE-2024-25628Insufficient Session Expiration in alf.io | Exploitation statusNot known exploited | FixNot confirmed | Affected productalf.io | Published02/16/2024 | SeverityHigh |
CVE-2023-2259Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io | Exploitation statusPublic exploit | FixYes | Affected productalfio-event/alf.io | Published04/24/2023 | SeverityCritical |
CVE-2023-2260Authorization Bypass Through User-Controlled Key in alfio-event/alf.io | Exploitation statusNot known exploited | FixYes | Affected productalfio-event/alf.io | Published04/24/2023 | SeverityHigh |
CVE-2023-2258Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io | Exploitation statusNot known exploited | FixYes | Affected productalfio-event/alf.io | Published04/24/2023 | SeverityHigh |
CVE-2023-0301Cross-site Scripting (XSS) - Stored in alfio-event/alf.io | Exploitation statusPublic exploit | FixYes | Affected productalfio-event/alf.io | Published01/14/2023 | SeverityMedium |
CVE-2023-0300Cross-site Scripting (XSS) - Reflected in alfio-event/alf.io | Exploitation statusPublic exploit | FixYes | Affected productalfio-event/alf.io | Published01/14/2023 | SeverityLow |
