JavaScript Injection Vulnerability in Entradium Promoter Profile
CVE-2026-7175

4.8MEDIUM

Key Information:

Vendor

Crocantickets

Status
Entradium
Vendor
CVE Published:
1 October 2026

What is CVE-2026-7175?

This vulnerability allows an attacker to inject malicious JavaScript code via the Business Name parameter in the /promoters/edit endpoint of the My Profile section. When exploited, this code executes on the public page of the promoter, potentially leading to unauthorized actions or data exposure. It highlights a significant security issue that could compromise the integrity of user profiles and their data.

Affected Version(s)

Entradium versions before 20260409151659 and 20260409153543.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cosme Vázquez Tomé
.