Redaxo CMS Addon MyEvents 2.2.1 contains a SQL injection flaw that lets attackers craft GET requests to the event_add.php page with malicious myevents_id values. By sending injected SQL code, an attacker can retrieve, modify or delete sensitive records from the database, potentially leaking confidential data or corrupting information.

The vulnerable addon, released by wende60 for the Redaxo CMS platform, is affected in version 2.2.1. Any installation of Redaxo CMS that has MyEvents 2.2.1 deployed is at risk; the CWE classification for this weakness is CWE-89.

The CVSS score of 7.1 indicates a high severity impact, and the absence of an EPSS measurement or KEV listing means exploitation likelihood is not quantified at present. The flaw requires that the attacker already has authenticated access to the CMS, which limits the attack surface but still permits serious data compromise if credentials are obtained or already present.