Medium
Multiple vulnerabilities in Entradium by Crocantickets
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.
Announced Source revision 1
Original source ↗CVE-2026-7176
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-7176
Entradium
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Crocantickets",
"product": "Entradium",
"versions": [
{
"status": "affected",
"version": "versions before 20260409151659 and 20260409153543."
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-7176
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #7718 · Revision 1
- Added to Heist Feed
- Publisher date