CVE-2026-101270CWE-79cross-site-scripting

CVE-2026-101270

published September 29, 2026

CVSS
2.1
EPSS
0%
Percentile
7.7
In the wild
Unconfirmed
What it is

Malicious HTML content could be injected into the help texts of various fields with organizer permissions.

The record
Technical detail
CVSS
2.1 · NONE
CVSS v4.0
2.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00185 · 7.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-29T17:17Z
References (1)
https://pretix.eu/about/en/blog/20260929-release-2026-7-1/ · 655498c3-6ec5-4f0b-aea6-853b334d05a6
EPSS history
Timeline
  • 01 OCT 03:44Z
    EPSS moved — → 0%
    epss
  • 29 SEP 12:02Z
    HTML injection
    cvelistv5