HTML injection

Why this deserves its current priority

CVSS is 2.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps pretix/pretix (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for pretix/pretix.
2. 2Review the reported fix. Update pretix/pretix to 2026.5.5 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 29, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 29, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 29, 2026

Sources and claim methodology

• Source referencepretix.eu

Related CVEs

• Webmin: Reflected XSS in the Configuration moduleAlso CWE-79
• Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jspSame generic ecosystem
• lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memorySame generic ecosystem
• wsl-pro-service: Ubuntu Pro token exposed via process command-line argumentsSame generic ecosystem
• mahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injectionSame generic ecosystem
• lib0 `readFromDataView` out-of-bounds readSame generic ecosystem