alf records

10 published records for vendor alf.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 20%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

10 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-35482No exploit	alf.io has an Authenticated RCE via Extension Script Sandbox Escapealf · alf · CWE-863 RCE Broken access control (IDOR)	Critical9.1	—	0.4%	Jun 2, 2026
35Monitor	CVE-2023-2258No exploit	Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.ioalf · alf · CWE-1236 Pre-auth	High8.8	—	0.9%	Apr 24, 2023
35Monitor	CVE-2023-2260No exploit	Authorization Bypass Through User-Controlled Key in alfio-event/alf.ioalf · alf · CWE-639 Broken access control (IDOR)	High8.8	—	0.8%	Apr 24, 2023
35Monitor	CVE-2024-25635No exploit	IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERSalf · alf · CWE-612 Broken access control (IDOR)	High8.8	—	0.7%	Feb 19, 2024
30Monitor	CVE-2024-25628No exploit	Insufficient Session Expiration in alf.ioalf · alf · CWE-613	High7.6	—	0.3%	Feb 16, 2024
28Monitor	CVE-2023-2259No exploit	Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.ioalf · alf · CWE-1336 RCE SSTI	High7.2	—	1.0%	Apr 24, 2023
26Monitor	CVE-2024-25634No exploit	IDOR make user can read e-mail log sent by other eventsalf · alf · CWE-497 Broken access control (IDOR) Info leak	Medium6.5	—	0.7%	Feb 19, 2024
26Monitor	CVE-2024-45299No exploit	alf.io's preloaded data as json is not escaped correctlyalf · alf · CWE-116	Medium6.5	—	0.7%	Sep 6, 2024
23Monitor	CVE-2024-45300No exploit	Bypassing promo code limitations with race conditionsalf · alf · CWE-362 Pre-auth Race condition	Medium5.9	—	0.4%	Sep 6, 2024
19Monitor	CVE-2024-25627No exploit	Cross-Site Scripting (XSS) via File Upload in Alf.ioalf · alf · CWE-79 XSS	Medium4.8	—	0.4%	Feb 16, 2024

CVE-2026-35482
36Monitor
alf.io has an Authenticated RCE via Extension Script Sandbox Escape
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
alf · alfJun 2, 2026
CVE-2023-2258
35Monitor
Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
alf · alfApr 24, 2023
CVE-2023-2260
35Monitor
Authorization Bypass Through User-Controlled Key in alfio-event/alf.io
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
alf · alfApr 24, 2023
CVE-2024-25635
35Monitor
IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
alf · alfFeb 19, 2024
CVE-2024-25628
30Monitor
Insufficient Session Expiration in alf.io
HighCVSS 7.6No exploitEPSS 0%
alf · alfFeb 16, 2024
CVE-2023-2259
28Monitor
Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io
HighCVSS 7.2No exploitEPSS 1%
- RCE
- SSTI
alf · alfApr 24, 2023
CVE-2024-25634
26Monitor
IDOR make user can read e-mail log sent by other events
MediumCVSS 6.5No exploitEPSS 0%
- Broken access control (IDOR)
- Info leak
alf · alfFeb 19, 2024
CVE-2024-45299
26Monitor
alf.io's preloaded data as json is not escaped correctly
MediumCVSS 6.5No exploitEPSS 0%
alf · alfSep 6, 2024
CVE-2024-45300
23Monitor
Bypassing promo code limitations with race conditions
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- Race condition
alf · alfSep 6, 2024
CVE-2024-25627
19Monitor
Cross-Site Scripting (XSS) via File Upload in Alf.io
MediumCVSS 4.8No exploitEPSS 0%
- XSS
alf · alfFeb 16, 2024