CVE-2026-7174: Multiple vulnerabilities in Entradium by Crocantickets

Published Oct 1, 2026

Updated

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discountwizard/discountconfig during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.

Affected Software

1 affected component

Crocantickets Entradium

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Entradium by Crocantickets to a version that resolves this vulnerability.
Fixed in 20260409151659
Upgrade
Upgrade Entradium by Crocantickets to a version that resolves this vulnerability.
Fixed in 20260409153543

Event History

Oct 1, 2026

CVE Published

via MITRE·09:54 AM

Data Sourced

via MITRE·09:54 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access and user interaction are required for exploitation?

The attacker needs low-level privileges to submit crafted values in the Name or Field parameters while creating discounts for an event. A victim must then view the affected event's discount list for the injected JavaScript to execute.

Who is exposed to the injected code?

Users who display the discount list for an event containing the malicious discount data are exposed. The stated impact includes theft of the victim's session data.