Export limit exceeded: 26203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-7176

Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Crocantickets
Products
Entradium
CVE-2026-7175

Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows the injection of JavaScript code that will execute on the promoter’s public page;

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Crocantickets
Products
Entradium
CVE-2026-7174

Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Crocantickets
Products
Entradium
CVE-2026-7173

Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. * (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page. * (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Crocantickets
Products
Entradium