Cross-Site Scripting in Entradium by Crocantickets
CVE-2026-7173

4.8MEDIUM

Key Information:

Vendor

Crocantickets

Status
Entradium
Vendor
CVE Published:
1 October 2026

What is CVE-2026-7173?

A Cross-Site Scripting (XSS) vulnerability exists in the Entradium platform by Crocantickets, which could enable remote attackers to execute unauthorized JavaScript in the context of victim users. Specifically, when users create or edit events, the City parameter in the /events/<event_name>/edit_general endpoint is susceptible to stored XSS, allowing malicious scripts to be injected and run on the event's public page. Additionally, the Description parameter in the /events/<event_name>/edit-general endpoint is vulnerable to reflected XSS if the required fields are not filled out. Successful exploitation can lead to the theft of session data, posing significant risks to user privacy and security.

Affected Version(s)

Entradium versions before 20260409151659 and 20260409153543.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cosme Vázquez Tomé
.