Entradium
Monthly
Stored cross-site scripting in the Entradium event-ticketing platform allows an authenticated event organizer to inject JavaScript into the Help text and Title parameters of the /events/<event_name>-<event_city>/custom_form/edit endpoint when creating or editing forms tied to an event's ticket sales; the payload persists and executes in the browser of any user who subsequently loads that event's public ticket-purchase page. Rated CVSS 4.8 (CVSS 4.0) and assessed independently as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, the issue is bounded by the low-privileged organizer account required for injection and the victim-visit condition needed for execution, yielding low confidentiality and integrity impact scoped to the affected event page. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Stored cross-site scripting in Entradium lets an authenticated promoter inject JavaScript into the Business Name field at the /promoters/edit endpoint, and that payload executes in the browser of anyone who later loads the promoter's public profile page. Because the injection point is a field the attacker already controls, the payload only reaches visitors of that specific promoter page rather than arbitrary chosen victims, and it requires victim interaction (the page must be loaded) - authentication as a promoter is required (PR:L in the assessed vector). No public exploit code or confirmed active exploitation was identified at time of analysis, and the low CVSS 4.0 base score (4.8) reflects limited confidentiality and integrity impact.
Stored cross-site scripting in Entradium (by Crocantickets) allows an authenticated attacker with privileges to create event discounts to inject JavaScript into the Name or Field parameters of the /tools/discount_wizard/discount_config endpoint; the payload executes when a victim views an event's discount list page, potentially leading to session data theft if the victim interacts with a crafted URL. The vendor-assigned CVSS 4.0 score is 4.8 (MEDIUM), consistent with the independent assessment that this is a low-to-moderate priority issue requiring authentication and user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Stored and reflected cross-site scripting in Entradium (by Crocantickets) lets an authenticated promoter-level account inject JavaScript through the event creation/editing workflow: the City parameter at /events/<event_name>/edit_general is stored and executes on the event's public page, while the Description parameter at /events/<event_name>/edit-general is reflected when required fields are left blank and the resulting crafted URL is delivered to a victim. Both variants require victim interaction (viewing the public event page or clicking the attacker-supplied link) and a promoter-level account, which keeps realistic exploitability low to moderate; the vendor CVSS 4.0 base score is 4.8, and the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status. Successful exploitation could allow theft of session data from users who view the affected event page or follow the crafted link.
Stored cross-site scripting in the Entradium event-ticketing platform allows an authenticated event organizer to inject JavaScript into the Help text and Title parameters of the /events/<event_name>-<event_city>/custom_form/edit endpoint when creating or editing forms tied to an event's ticket sales; the payload persists and executes in the browser of any user who subsequently loads that event's public ticket-purchase page. Rated CVSS 4.8 (CVSS 4.0) and assessed independently as AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, the issue is bounded by the low-privileged organizer account required for injection and the victim-visit condition needed for execution, yielding low confidentiality and integrity impact scoped to the affected event page. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Stored cross-site scripting in Entradium lets an authenticated promoter inject JavaScript into the Business Name field at the /promoters/edit endpoint, and that payload executes in the browser of anyone who later loads the promoter's public profile page. Because the injection point is a field the attacker already controls, the payload only reaches visitors of that specific promoter page rather than arbitrary chosen victims, and it requires victim interaction (the page must be loaded) - authentication as a promoter is required (PR:L in the assessed vector). No public exploit code or confirmed active exploitation was identified at time of analysis, and the low CVSS 4.0 base score (4.8) reflects limited confidentiality and integrity impact.
Stored cross-site scripting in Entradium (by Crocantickets) allows an authenticated attacker with privileges to create event discounts to inject JavaScript into the Name or Field parameters of the /tools/discount_wizard/discount_config endpoint; the payload executes when a victim views an event's discount list page, potentially leading to session data theft if the victim interacts with a crafted URL. The vendor-assigned CVSS 4.0 score is 4.8 (MEDIUM), consistent with the independent assessment that this is a low-to-moderate priority issue requiring authentication and user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Stored and reflected cross-site scripting in Entradium (by Crocantickets) lets an authenticated promoter-level account inject JavaScript through the event creation/editing workflow: the City parameter at /events/<event_name>/edit_general is stored and executes on the event's public page, while the Description parameter at /events/<event_name>/edit-general is reflected when required fields are left blank and the resulting crafted URL is delivered to a victim. Both variants require victim interaction (viewing the public event page or clicking the attacker-supplied link) and a promoter-level account, which keeps realistic exploitability low to moderate; the vendor CVSS 4.0 base score is 4.8, and the independent assessment scores it CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. No public exploit identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status. Successful exploitation could allow theft of session data from users who view the affected event page or follow the crafted link.