JavaScript Injection in Ticket Sales Forms for Entradium by CrocanTickets
CVE-2026-7176

4.8MEDIUM

Key Information:

Vendor

Crocantickets

Status
Entradium
Vendor
CVE Published:
1 October 2026

What is CVE-2026-7176?

A vulnerability in the Entradium platform, associated with CrocanTickets, allows attackers to inject malicious JavaScript through the Help text and Title parameters in the editing endpoint for event ticket sales forms. This injection can occur during the creation or modification of forms, leading to potential execution of harmful scripts on public ticket purchase pages, compromising user data and the integrity of the event's ticketing process.

Affected Version(s)

Entradium versions before 20260409151659 and 20260409153543.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Cosme Vázquez Tomé
.