CVE-2026-7176CWE-79cross-site-scripting

CVE-2026-7176

published October 1, 2026

CVSS
4.8
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

CVE-2026-7176: the Help text and Title parameters in the endpoint /events/<event_name>-<event_city>/custom_form/edit during the process of creating or modifying forms associated with ticket sales for an event, which allows for the injection of JavaScript that will execute on the public ticket purchase page for the event.

The record
Technical detail
CVSS
4.8 · NONE
CVSS v4.0
4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00234 · 13.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-01T14:17Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-entradium-crocantickets · [email protected]
EPSS history
Timeline
  • 03 OCT 03:46Z
    EPSS moved — → 0%
    epss
  • 01 OCT 09:54Z
    Multiple vulnerabilities in Entradium by Crocantickets
    cvelistv5