CVE-2026-57533
2.1
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Summary
Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pretix | pretix | 0 < 2026.3.4 | affected |
| pretix | pretix | 2026.4.0 < 2026.4.4 | affected |
| pretix | pretix | 2026.5.0 < 2026.5.2 | affected |
Weaknesses
- CWE-80: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.