Threat database

CVE-2026-7176 is a cross-site scripting (XSS) vulnerability in Crocantickets Entradium affecting the Help text and Title parameters of the /events/<event_name>-<event_city>/custom_form/edit endpoint. This flaw allows injection of JavaScript code that executes on the public ticket purchase page for an event. The vulnerability arises during the creation or modification of forms related to ticket sales. The CVSS 4.0 score is 4.8, indicating a medium severity issue. No affected versions or patch information are provided.

CVE-2026-7175 is a cross-site scripting (XSS) vulnerability in the Crocantickets Entradium product. It affects the Business Name parameter in the /promoters/edit endpoint within the My Profile section of a promoter's profile. This flaw allows injection of JavaScript code that executes on the promoter's public page. The vulnerability has a CVSS 4.8 score, indicating medium severity. No affected versions or patch information are provided.

CVE-2026-7174 is a stored cross-site scripting (XSS) vulnerability in Crocantickets Entradium. It affects the Name and Field parameters of the /tools/discount_wizard/discount_config endpoint used during discount creation for events. This flaw allows injection of malicious JavaScript code that executes when the event's discount list page is viewed. Exploitation requires a user to visit a crafted URL, potentially leading to session data theft.

CVE-2026-7173 is a medium severity cross-site scripting (XSS) vulnerability in Crocantickets Entradium. It involves improper neutralization of input in the City and Description parameters during event creation or editing. The City parameter is vulnerable to stored XSS, allowing JavaScript injection that executes on the event's public page. The Description parameter is vulnerable to reflected XSS when required fields are not filled. Exploitation could allow remote attackers to steal session data via specially crafted URLs.