Entradium EUVD-2026-90743

Exploitation requires an authenticated promoter account (PR:L) able to reach the event creation/editing workflow. Stored XSS: inject JavaScript into the City parameter at /events/<event_name>/edit_general while creating or editing a promoter-assigned event; the payload then executes for anyone viewing that event's public page. Reflected XSS: supply a payload in the Description parameter at /events/<event_name>/edit-general when submitting an event with required fields left blank, and deliver the resulting crafted URL to a victim. Both variants require victim interaction (UI:A) - either visiting the public event page or clicking the attacker-supplied link - which, together with the promoter-level authentication requirement, limits realistic exploitation.

This is a genuinely low-to-moderate priority issue, not a high-CVSS inflation case. The vendor-supplied CVSS 4.0 base score is 4.8 (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N) - a network-reachable but authenticated (PR:L, a promoter account) cross-site scripting flaw whose only confirmed technical impact is limited integrity (VI:L); the vendor assigns no confidentiality impact (VC:N) even though the description states session data can be stolen, so there is mild internal inconsistency between the narrative ('steal their session data', implying some confidentiality loss) and the scored VC:N - worth noting but it does not materially change the modest severity. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The combination of required promoter-level authentication, required victim interaction (UI:A), and a niche affected product keeps real-world risk low despite the network attack vector. Treat as a routine patch-when-available item rather than an emergency.

An attacker who holds (or obtains) a promoter account edits an event and injects JavaScript into the City field via /events/<event_name>/edit_general; the payload is stored and then executes in the browser of any visitor to the event's public page (stored XSS), enabling session/cookie theft. Alternatively, the attacker crafts a URL targeting the Description parameter on the edit-general endpoint and sends it to a victim, whose browser reflects and runs the script (reflected XSS). No public proof-of-concept was provided, and both paths require the authenticated promoter workflow plus victim interaction.