Adam Młynarczyk

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.0 **Description** Missing server-side visibility enforcement allows unauthenticated attackers to purchase hidden tickets. By referencing hidden product and price IDs in order creation requests, attackers can bypass authorization checks. This is possible by enumerating sequential hidden ticket IDs based on visible ones to acquire VIP, invite-only, or discounted tickets that were intentionally withheld from public sale. **Recommendations** Update Hi.Events to version 1.11.0 or later.

**Name of the Vulnerable Software and Affected Versions** Hi.Events versions prior to 1.11.0 **Description** Authenticated attackers with event creation or edit permissions can perform cross-site scripting by embedding a malicious event title containing the `</script>` sequence. This occurs because the sequence is not escaped by `JSON.stringify()` when embedded in inline script tags. This allows the attacker to break out of the script context within the `application/ld+json` structured data block or server-side rehydrated state, executing arbitrary HTML and JavaScript in the browser of any user viewing the public event page, including unauthenticated visitors and administrators. **Recommendations** Update to version 1.11.0 or later.