Entradium EUVD-2026-90745

Requires an authenticated promoter account (PR:L) with access to the My Profile section and the ability to edit the Business Name parameter at the /promoters/edit endpoint. Exploitation is limited by the need for victim interaction (UI:A): the stored payload only executes when a visitor loads the affected promoter's public profile page. This is a stored/persistent XSS confined to the self-controlled Business Name field, so an attacker cannot target arbitrary victims directly - impact depends on who visits that specific promoter page. No special non-default configuration is noted beyond having a usable promoter profile on the Entradium platform.

This is a low-to-moderate real-world risk best characterized as a high-visibility-but-low-impact issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N, 4.8) indicates a network-reachable, low-complexity attack that nonetheless requires low-privilege authentication (PR:L - an attacker must hold a legitimate promoter account) and active victim interaction (UI:A - a victim must load the promoter's public page). This is a self-injected stored XSS: the promoter poisons their own Business Name field, and the payload only fires in the browsers of visitors to that public page, limiting impact to low confidentiality and low integrity (VC:L/VI:L), with no availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided - so there is no public exploit identified at time of analysis. No signals conflict here; all available data (CVSS, CWE-79, description) point consistently to a contained, interaction-and-authentication-gated XSS rather than an urgent priority. The main caveat is that INCIBE's advisory covers 'multiple vulnerabilities' in Entradium, so this CVE should be triaged alongside its siblings rather than in isolation.

An attacker registers or already holds a promoter account on an Entradium-based ticketing site and edits their My Profile 'Business Name' field at /promoters/edit, inserting a JavaScript payload instead of a legitimate name. When any visitor (another user, or an admin reviewing promoters) loads that promoter's public page, the stored script executes in their browser session, enabling session-context actions such as cookie/token theft or UI manipulation. No public proof-of-concept is available at time of analysis, and exploitation requires both a valid promoter account and a victim viewing the public page.