PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-105889 Tickera CVE debrief

CVE-2026-105889 is a SQL injection vulnerability in the Tickera tickera-event-ticketing-system plugin, affecting versions from n/a through 3.6.0.6. This issue allows for Blind SQL Injection and has a CVSS score of 9.3, indicating critical severity. The vulnerability can lead to potential unauthorized data access. Defenders should verify exposure, prioritize remediation, and monitor for potential Blind SQL Injection attempts. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions.

Vendor
Tickera
Product
Unknown
CVSS
CRITICAL 9.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-10
Original CVE updated
2026-10-10
Advisory published
2026-10-10
Advisory updated
2026-10-10

Who should care

Defenders and security teams responsible for maintaining and securing systems that use the Tickera tickera-event-ticketing-system plugin should assess exposure and prioritize remediation.

Why it matters

CVE-2026-105889 is a critical SQL injection vulnerability in the Tickera tickera-event-ticketing-system plugin. Defenders should verify exposure, prioritize remediation, and monitor for potential Blind SQL Injection attempts. The vulnerability allows for potential unauthorized data access and has a high CVSS score indicating critical severity.

  • Potential for unauthorized data access through Blind SQL Injection.
  • Need for verification of plugin version and exposure in the environment.
  • Priority for applying remediation or compensating controls to prevent exploitation.
  • Potential impact on data confidentiality due to the high CVSS score.

Technical summary

The Tickera tickera-event-ticketing-system plugin has a SQL injection vulnerability, specifically a Blind SQL Injection issue, affecting versions from n/a through 3.6.0.6. The vulnerability has a CVSS score of 9.3, indicating critical severity. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L.

Defensive priority

Defenders should prioritize verifying exposure and applying remediation for this vulnerability, especially in systems using the affected plugin versions.

Recommended defensive actions

  • Verify if the Tickera tickera-event-ticketing-system plugin version is within the affected range (from n/a through 3.6.0.6) in your environment.
  • Apply the latest version of the Tickera plugin if available, or follow vendor recommendations for remediation.
  • Monitor for potential Blind SQL Injection attempts in your system logs.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and affected versions. However, additional information on exploitation or specific impacts is not provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-105889 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-105889

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-105889 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-105889

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.