Description

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.

Severity (CVSS)

Base score2.1
SeverityLow
VersionCVSS 4.0
VectorCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Provided byCNA

Weaknesses

  • CWE-80 — CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)

Affected products

VendorProductVersions
pretixpretix0 to <2026.3.4; 2026.4.0 to <2026.4.4; 2026.5.0 to <2026.5.2

References

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 26 Jun 2026 07:05 UTC.