Entradium CVE-2026-7176

Exploitation requires an authenticated account with privileges to create or modify event ticket forms (an event organizer role) in order to reach /events/<event_name>-<event_city>/custom_form/edit and inject into the Help text or Title fields; this is the PR:L gate. The stored payload then executes only when a user loads that event's public ticket-purchase page (the UI:A/victim-visit condition). It does not permit unauthenticated injection and is scoped to users interacting with the affected event's purchase page.

This is a stored (persistent) cross-site scripting flaw (CWE-79) in the Entradium event-ticketing platform, reported by Spain's national CERT (INCIBE). The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N, base 4.8) describes a network-reachable, low-complexity attack that nevertheless requires attacker privileges (PR:L - an authenticated event organizer able to create/edit ticket forms) and active victim interaction (UI:A - a buyer must load the public ticket-purchase page). Impact is limited to low confidentiality and low integrity within the victim's browser session, with no availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data - exploitation status is 'no public exploit identified at time of analysis.' All signals converge on a genuinely moderate issue rather than a high-urgency one: the requirement for an authenticated form-editing role gates the attack to event organizers (or a compromised organizer account), and the real-world blast radius is scoped to the browsers of users purchasing tickets for that specific event. One note of caution: the vector marks UI:A (active/required interaction), but because the payload executes automatically when the public ticket page is rendered, a defender should treat victim interaction as merely 'visiting the page' rather than an explicit click.

An authenticated event organizer (or an attacker who has taken over such an account) edits a ticket form at /events/<event_name>-<event_city>/custom_form/edit and inserts a malicious JavaScript payload into the Help text or Title field. When any member of the public subsequently opens that event's ticket-purchase page, the stored script executes in their browser, enabling session/credential theft, redirection, or content manipulation. No public exploit code is referenced, but the injection point and trigger are fully described by INCIBE.