Skip to contentAlfio-event Alf.io vulnerabilities
- alfio-event alf.ioalf.io has Improper Access Control for Organization Owners that Exposes System SecretsCVE-2026-501657.1 High
- alfio-event alf.ioalf.io vulnerable to Arbitrary File Read and Exfil via simpleHttpClient Extension ScriptCVE-2026-414124.9 Medium
- alf, alfio-event alf.io +1 morealf.io has an Authenticated RCE via Extension Script Sandbox EscapeCVE-2026-354828.0 High
- alf, alfio-event alf.io +1 moreBypassing promo code limitations with race conditionsCVE-2024-453007.5 High
- alf, alfio-event alf.io +1 morealf.io's preloaded data as json is not escaped correctlyCVE-2024-452996.5 Medium
- alf, alfio-event alf.io +1 moreIDOR make user can read e-mail log sent by other eventsCVE-2024-256347.2 High
- alf, alfio-event alf.io +1 moreIDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERSCVE-2024-256358.8 High
- alf, alfio-event alf.io +1 moreCross-Site Scripting (XSS) via File Upload in Alf.ioCVE-2024-256273.5 Low
- alf, alfio-event alf.io +1 moreInsufficient Session Expiration in alf.ioCVE-2024-256287.6 High
- alf, alfio-event alfio-event/alf.io +1 moreAuthorization Bypass Through User-Controlled Key in alfio-event/alf.ioCVE-2023-22608.8 High
- alf, alfio-event alfio-event/alf.io +1 moreImproper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.ioCVE-2023-22599.1 Critical
- alf, alfio-event alfio-event/alf.io +1 moreImproper Neutralization of Formula Elements in a CSV File in alfio-event/alf.ioCVE-2023-22588.8 High
- alfio-event alfio-event/alf.io, opencollective alf.io +1 moreCross-site Scripting (XSS) - Stored in alfio-event/alf.ioCVE-2023-03014.3 Medium
- alfio-event alfio-event/alf.io, opencollective alf.io +1 moreCross-site Scripting (XSS) - Reflected in alfio-event/alf.ioCVE-2023-03003.5 Low