Sbitsoft Eventobot vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Sbitsoft Eventobot: 2 record(s), with affected versions and fixes.
cpe:2.3:a:sbitsoft:eventobot

CVE-2025-40639 Critical · 9.8 CWE-89 Mar 9, 2026

SQL injection in Eventobot

A SQL injection vulnerability has been found in Eventobot. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'promo_send' parameter in the '/assets/php/calculate_discount.php'.

CVE-2025-40638 Medium · 6.1 CWE-79 Mar 9, 2026

Reflected Cross-Site Scripting (XSS) in Eventobot

A reflected Cross-Site Scripting (XSS) vulnerability has been found in Eventobot. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL using the 'name' parameter in '/search-results'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.