Quick answers
- Is CVE-2026-7174 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-7174 being exploited in the wild.
- How severe is CVE-2026-7174?
- Informational severity, published 1 October 2026.
- Which products and versions are affected?
- Crocantickets Entradium.
- Is there a fix for CVE-2026-7174?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-7174 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-7174?
- Check whether you run Crocantickets Entradium. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored XSS vulnerability exists in the Name and Field parameters of the /tools/discount_wizard/discount_config endpoint during discount creation. The injected JavaScript persists in the database and executes in the context of users viewing the event's discount list page. This requires administrative or event manager privileges to inject the payload but affects any user viewing the poisoned discount list.
Affected products
- Crocantickets Entradium
Timeline
- 2026-10-01: disclosed