CVE-2026-7173
Received Received - Intake

Stored XSS in Crocantickets Entradium Event Management

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. * (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page. * (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-7173
EUVD
EUVD-2026-90743

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
crocantickets entradium *
crocantickets entradium 20260409151659
crocantickets entradium 20260409153543

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-7173 is a Cross-Site Scripting (XSS) vulnerability in Entradium by Crocantickets. It allows a remote attacker to inject malicious JavaScript code through the City parameter in the /events/<event_name>/edit_general endpoint when creating or editing events. This injected script executes on the event’s public page, potentially enabling the attacker to steal session data.

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious requests to the /events/<event_name>/edit_general and /events/<event_name>/edit-general endpoints. Check for unusual JavaScript code in the City or Description parameters. Use tools like Burp Suite or OWASP ZAP to intercept and inspect HTTP requests for malicious payloads.

Impact Analysis

An attacker could exploit this vulnerability to steal a victim's session data by tricking them into clicking a specially crafted URL. This could lead to unauthorized access to the victim's account and sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized access to user session data, potentially exposing personal information. This may violate GDPR's data protection requirements and HIPAA's safeguards for protected health information if such data is compromised.

Mitigation Strategies

Immediately update Entradium to versions 20260409151659 or 20260409153543 or later. Implement input validation to sanitize the City and Description parameters. Use Content Security Policy (CSP) headers to mitigate XSS risks. Disable unnecessary event editing features if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7173. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart