CVE-2026-7176 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event...

CVE-2026-7176

The Entradium platform by Crocantickets is vulnerable to a JavaScript injection flaw. Specifically, the Help text and Title parameters in the /events/-/custom_form/edit endpoint lack proper sanitization during the creation or modification of ticket sale forms. This allows an attacker to inject ma...

CVE-2026-7175

The Entradium platform by Crocantickets is vulnerable to a script injection flaw in the My Profile section. Specifically, the Business Name parameter within the /promoters/edit endpoint fails to properly sanitize input, allowing for the injection of JavaScript code . This malicious script can exe...

CVE-2026-7174 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to ...

CVE-2026-7174

The Entradium platform by Crocantickets is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the Name and Field parameters of the /tools/discount_wizard/discount_config endpoint during the discount creation process. Attackers can inject malicious JavaScript code...

CVE-2026-7173

The Entradium platform by Crocantickets contains Cross-Site Scripting (XSS) vulnerabilities. A Stored XSS exists in the City parameter of the /events//edit_general endpoint, allowing JavaScript injection that executes on an event's public page when editing events assigned to a promoter. Additiona...

CVE-2026-7173 Multiple vulnerabilities in Entradium by Crocantickets

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. Stored XSS The City parameter in the endpoint /events//editgeneral during...