Vulnerability · Published Oct 1, 2026 · Assigned by INCIBE
CVE-2026-7173Multiple vulnerabilities in Entradium by Crocantickets
Medium 4.8
In plain English
A medium-severity cross-site scripting in Entradium from Crocantickets. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. * (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page. * (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Crocantickets | Entradium | versions before 20260409151659 and 20260409153543. |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N