https://vulnogram.org/ Most recent CVEs assigned by rami.io GmbH (rami.io). https://vulnogram.org/seaview/icons/rami.io.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-101271 https://vulnogram.org/CVE-2026-101271 OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled. Low Tue, 29 Sep 2026 12:03:44 GMT https://vulnogram.org/CVE-2026-101270 https://vulnogram.org/CVE-2026-101270 Malicious HTML content could be injected into the help texts of various fields with organizer permissions. Low Tue, 29 Sep 2026 12:02:10 GMT https://vulnogram.org/CVE-2026-101269 https://vulnogram.org/CVE-2026-101269 The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only e… Low Tue, 29 Sep 2026 12:01:29 GMT https://vulnogram.org/CVE-2026-101268 https://vulnogram.org/CVE-2026-101268 If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account.… Low Network Exploitable Tue, 29 Sep 2026 12:00:41 GMT https://vulnogram.org/CVE-2026-101267 https://vulnogram.org/CVE-2026-101267 A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue. Low Network Exploitable Tue, 29 Sep 2026 11:59:34 GMT https://vulnogram.org/CVE-2026-101266 https://vulnogram.org/CVE-2026-101266 A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps. Low Tue, 29 Sep 2026 11:53:52 GMT https://vulnogram.org/CVE-2026-82838 https://vulnogram.org/CVE-2026-82838 The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set. Medium Mon, 31 Aug 2026 07:44:09 GMT https://vulnogram.org/CVE-2026-18028 https://vulnogram.org/CVE-2026-18028 The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given… Low Tue, 28 Jul 2026 10:39:48 GMT https://vulnogram.org/CVE-2026-18029 https://vulnogram.org/CVE-2026-18029 Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple… Medium Network Exploitable Tue, 28 Jul 2026 10:39:29 GMT https://vulnogram.org/CVE-2026-13602 https://vulnogram.org/CVE-2026-13602 We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa,… High Wed, 01 Jul 2026 13:45:30 GMT https://vulnogram.org/CVE-2026-13603 https://vulnogram.org/CVE-2026-13603 The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is… Critical Network Exploitable Wed, 01 Jul 2026 13:18:09 GMT https://vulnogram.org/CVE-2026-13350 https://vulnogram.org/CVE-2026-13350 Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. Low Thu, 25 Jun 2026 16:05:11 GMT https://vulnogram.org/CVE-2026-57532 https://vulnogram.org/CVE-2026-57532 Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend… High Thu, 25 Jun 2026 14:32:37 GMT https://vulnogram.org/CVE-2026-57533 https://vulnogram.org/CVE-2026-57533 Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes. Low Thu, 25 Jun 2026 14:31:18 GMT https://vulnogram.org/CVE-2026-57535 https://vulnogram.org/CVE-2026-57535 Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, the… Low Thu, 25 Jun 2026 14:29:18 GMT https://vulnogram.org/CVE-2026-13225 https://vulnogram.org/CVE-2026-13225 Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order. Medium Network Exploitable Thu, 25 Jun 2026 14:26:31 GMT https://vulnogram.org/CVE-2026-57534 https://vulnogram.org/CVE-2026-57534 Malicious HTML content could be injected into the content of a page in the pretix-pages plugin. Low Thu, 25 Jun 2026 14:11:13 GMT https://vulnogram.org/CVE-2026-57536 https://vulnogram.org/CVE-2026-57536 Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid… Medium Network Exploitable Thu, 25 Jun 2026 14:08:37 GMT https://vulnogram.org/CVE-2026-13222 https://vulnogram.org/CVE-2026-13222 Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining acce… Medium Network Exploitable Thu, 25 Jun 2026 14:07:03 GMT https://vulnogram.org/CVE-2026-13223 https://vulnogram.org/CVE-2026-13223 Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining a… Medium Network Exploitable Thu, 25 Jun 2026 14:03:54 GMT https://vulnogram.org/CVE-2026-13314 https://vulnogram.org/CVE-2026-13314 Malicious HTML content could be injected into the content rendered by the pretix-digital plugin. Low Thu, 25 Jun 2026 13:53:07 GMT https://vulnogram.org/CVE-2026-12863 https://vulnogram.org/CVE-2026-12863 An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains. Medium Mon, 22 Jun 2026 08:41:33 GMT https://vulnogram.org/CVE-2026-12862 https://vulnogram.org/CVE-2026-12862 Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file. Medium Mon, 22 Jun 2026 08:26:10 GMT https://vulnogram.org/CVE-2026-11764 https://vulnogram.org/CVE-2026-11764 When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the f… Low Tue, 09 Jun 2026 11:54:37 GMT https://vulnogram.org/CVE-2026-9712 https://vulnogram.org/CVE-2026-9712 When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for downlo… Low Wed, 27 May 2026 14:35:58 GMT https://vulnogram.org/CVE-2026-5600 https://vulnogram.org/CVE-2026-5600 A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other… Medium Wed, 08 Apr 2026 12:24:51 GMT https://vulnogram.org/CVE-2026-5599 https://vulnogram.org/CVE-2026-5599 A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds. High Sun, 05 Apr 2026 12:36:27 GMT https://vulnogram.org/CVE-2026-4982 https://vulnogram.org/CVE-2026-4982 A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that… High Fri, 27 Mar 2026 12:32:41 GMT https://vulnogram.org/CVE-2026-2452 https://vulnogram.org/CVE-2026-2452 Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant… High Mon, 16 Feb 2026 10:16:22 GMT https://vulnogram.org/CVE-2026-2451 https://vulnogram.org/CVE-2026-2451 Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant… High Mon, 16 Feb 2026 10:16:05 GMT https://vulnogram.org/CVE-2026-2415 https://vulnogram.org/CVE-2026-2415 Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two security-relevan… High Mon, 16 Feb 2026 10:15:09 GMT https://vulnogram.org/CVE-2025-14881 https://vulnogram.org/CVE-2025-14881 Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. Low Fri, 19 Dec 2025 12:24:10 GMT https://vulnogram.org/CVE-2025-14882 https://vulnogram.org/CVE-2025-14882 An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only. Low Fri, 19 Dec 2025 12:24:01 GMT https://vulnogram.org/CVE-2025-13742 https://vulnogram.org/CVE-2025-13742 Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or… Low Network Exploitable Thu, 27 Nov 2025 11:04:36 GMT https://vulnogram.org/CVE-2024-9575 https://vulnogram.org/CVE-2024-9575 Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5. High Wed, 09 Oct 2024 09:40:44 GMT https://vulnogram.org/CVE-2024-8113 https://vulnogram.org/CVE-2024-8113 Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scr… High Fri, 23 Aug 2024 14:18:05 GMT