Entradium EUVD-2026-90744

Requires an authenticated account with privileges to create event discounts via the /tools/discount_wizard/discount_config endpoint (PR:L) - not exploitable by anonymous users. The attacker injects JavaScript into the discount Name or Field parameters; the payload only executes when a victim actively views that event's discount list page (UI:A), typically after the attacker delivers a crafted URL to lead the victim there. Limiting factors: attacker must hold discount-management access on the target event, and successful session theft depends on a victim interacting with the attacker-controlled link/page.

This is a genuinely low-to-moderate priority issue, not a high-CVSS inflation case - the vendor-assigned CVSS 4.0 score of 4.8 (MEDIUM) is consistent with the facts. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N) shows network-reachable, low-complexity exploitation but with two meaningful brakes: PR:L (the attacker must already hold an authenticated account able to create event discounts) and UI:A (active victim interaction is required to view the discount list page where the payload fires). Impact is limited to VI:L - reflecting script execution in the victim's browser session rather than server compromise. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is: no public exploit identified at time of analysis. The only cited source is a single INCIBE-CERT advisory, meaning this is a vendor/CERT-reported finding with no independent corroboration of in-the-wild activity. Note a mild internal tension: the CWE and title say 'Stored XSS' (payload persisted at discount-creation time), yet the description's exploitation narrative ('send a specially crafted URL to the victim and steal their session data') reads more like a reflected/link-delivered vector - the practical attack likely combines a stored payload with a crafted link that routes the victim to the vulnerable discount list page; verify the exact delivery mechanism with the vendor/INCIBE.

An authenticated attacker with discount-management rights (PR:L) creates an event discount, injecting JavaScript into the Name or Field parameters of /tools/discount_wizard/discount_config. The attacker then sends a crafted URL to a victim user (UI:A); when the victim opens the event's discount list page, the stored script executes in their browser and exfiltrates session data. No public proof-of-concept code was identified at time of analysis.