Skip to content
Heist/ feed
Medium

Multiple vulnerabilities in Entradium by Crocantickets

Type: advisorySource: Official CVE List1 source record

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.

Announced Source revision 1
Original source ↗

CVE-2026-7174

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-7174

Entradium

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Crocantickets",
    "product": "Entradium",
    "versions": [
      {
        "status": "affected",
        "version": "versions  before 20260409151659 and 20260409153543."
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-7174

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#7715 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement