# CVE-2026-7174: Crocantickets Entradium stored XSS in discount configuration

Source: https://junglewise.ai/threats/cve-2026-7174-stored-cross-site-scripting-vulnerability-in-entradium-by  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-7174 · Severity: info · Published 2026-10-01

Entradium is a ticketing and event management system. A stored cross-site scripting vulnerability in the discount configuration feature allows attackers to inject malicious JavaScript that executes when event managers view discount lists, potentially enabling session hijacking and unauthorized access to user accounts.

Technologies: [Crocantickets Entradium](https://junglewise.ai/threats/technologies/entradium). Vendors: [Crocantickets](https://junglewise.ai/threats/vendors/crocantickets).

## Quick answers

**Is CVE-2026-7174 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7174 being exploited in the wild.

**How severe is CVE-2026-7174?** Informational severity, published 1 October 2026.

**Which products and versions are affected?** Crocantickets Entradium.

**Is there a fix for CVE-2026-7174?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-7174 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-7174?** Check whether you run Crocantickets Entradium. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored XSS vulnerability exists in the Name and Field parameters of the /tools/discount_wizard/discount_config endpoint during discount creation. The injected JavaScript persists in the database and executes in the context of users viewing the event's discount list page. This requires administrative or event manager privileges to inject the payload but affects any user viewing the poisoned discount list.

## Affected products

- Crocantickets Entradium

## Timeline

- 2026-10-01: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-entradium-crocantickets](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-entradium-crocantickets)

## Related threats

- [Crocantickets Entradium stored XSS in custom form edit](https://junglewise.ai/threats/cve-2026-7176-the-help-text-and-title-parameters-in-the-endpoint-events-event)
- [Crocantickets Entradium Cross-Site Scripting in event editing](https://junglewise.ai/threats/cve-2026-7173-cross-site-scripting-vulnerability-in-entradium-by-crocantickets)