Medium severity · published Oct 1, 2026
CVE-2026-7176
Multiple vulnerabilities in Entradium by Crocantickets
4.8
CVSS
0.2%
EPSS
No
On KEV
Description
CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EN
Entradium · Crocantickets
versions before 20260409151659 and 20260409153543. · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7176
www.incibe.es
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-entradium-crocantickets
More from Entradium
4.8
CVE-2026-7175
Multiple vulnerabilities in Entradium by Crocantickets
4.8
CVE-2026-7174
Multiple vulnerabilities in Entradium by Crocantickets
4.8
CVE-2026-7173
Multiple vulnerabilities in Entradium by Crocantickets