generated: '2026-09-07'
method: searched
source: https://www.cvent.com/en/event-management-software/vulnerability-disclosure-program
description: >-
  Cvent runs a published Vulnerability Disclosure Program with a stated research scope, stated
  out-of-bounds activities, a submission form, and a commitment to acknowledge each report. It is
  NOT advertised at /.well-known/security.txt — every host returns 404 for that path (see
  well-known/cvent-registration-well-known.yml) — so the programme is discoverable only through
  cvent.com and the trust center.
program:
  name: Cvent Vulnerability Disclosure Program
  url: https://www.cvent.com/en/event-management-software/vulnerability-disclosure-program
  http_status: 200
  verified: '2026-09-07'
  type: vulnerability-disclosure
  bug_bounty: false
  platform: null
  submission: Web form ("Report a Vulnerability") on the programme page
  contact_email: null
  security_txt: false
  pgp_key: false
  safe_harbor_stated: false
policy:
  confidentiality: >-
    Cvent requires that reported vulnerabilities be kept confidential and not publicly disclosed,
    and that the finding not have been previously reported.
  response_commitment: >-
    "The Cvent Security team will acknowledge receipt of each reported vulnerability, conduct a
    thorough investigation, and then take appropriate action for resolution."
  scope: Cvent services and products to which the researcher has authorized access.
  out_of_scope:
    - Any attempt to modify or delete data
    - Accessing, downloading or modifying accounts and data that do not belong to you
    - Denial of service (DoS/DDoS) testing
    - Sending unsolicited or unauthorized email, spam or other unsolicited messages
    - Testing third-party websites, applications or services that integrate with Cvent
    - Posting, transmitting, uploading, linking to or storing malware or similar harmful software
    - Any activity that violates applicable law
trust_center:
  url: https://trust.cvent.com/
  indicator: >-
    The trust center's "Has a bug bounty or vulnerability disclosure program" indicator links to
    this same programme page.