CVE-2026-7175 is an improper neutralization of input vulnerability (CWE-79) in Crocantickets Entradium. The Business Name parameter in the /promoters/edit endpoint does not properly sanitize input, enabling an attacker with low privileges and requiring user interaction to inject JavaScript code. This code executes in the context of the promoter's public page, potentially leading to client-side script execution. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and user interaction needed, with low impact on confidentiality and integrity, and no impact on availability.

An attacker can inject and execute arbitrary JavaScript code on a promoter's public page by exploiting the Business Name parameter. This could lead to client-side script execution affecting users who visit the promoter's page. The impact is limited by the need for user interaction and low privileges required to exploit the vulnerability. There is no indication of direct impact on system availability or data confidentiality beyond the client-side context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid entering untrusted input into the Business Name parameter and consider applying input validation or output encoding on the server side if possible.