CVE-2026-7176: Multiple vulnerabilities in Entradium by Crocantickets

Published Oct 1, 2026

Updated

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<eventname>-<eventcity>/customform/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.

Affected Software

1 affected component

Crocantickets Entradium

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Entradium to a version that resolves this vulnerability.
Fixed in 20260409151659
Upgrade
Upgrade Entradium to a version that resolves this vulnerability.
Fixed in 20260409153543

Event History

Oct 1, 2026

CVE Published

via MITRE·09:54 AM

Data Sourced

via MITRE·09:54 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs low-level privileges and must be able to create or modify forms associated with ticket sales for an event. Exploitation also requires a user to interact with the affected public ticket purchase page.

Where does the injected script execute?

JavaScript injected through the Help text or Title parameters executes on the public ticket purchase page for the affected event. This can affect visitors purchasing tickets for that event.