VDB
CVE-2026-13225
CVE-2026-13225
PUBLISHED
CVSS 5.3 MEDIUM
Reported by rami.io · Published June 25, 2026
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pretix | pretix | 0, 2026.4.0, 2026.5.0 |
| pretix | pretix | 0, 2026.4.0, 2026.5.0 |
Timeline
- Jun 25, 2026 CVE Published
- Jun 25, 2026 CVE Updated
- Jun 26, 2026 EPSS Score
- Jun 26, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score