CVE Feed

    Dashboard / CVE / CVE-2024-8113

    CVE-2024-8113

    Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.

    Published:Aug 23, 2024
    Last Modified:Sep 12, 2024
    EPS:Aug 23, 2024
    EPSS Score:0.00246
    CVSS Score:5.4

    Affected Products

    Vendor
    Pretix
    Product
    Pretix

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-18028 (CVSS 2.3) — The "quick setup" view presented to users after they first create an event allows to set up the most critical…
    CVE-2026-13602 (CVSS 7.7) — We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any us…
    CVE-2026-57532 (CVSS 8.8) — Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed whe…
    CVE-2026-57533 (CVSS 2.1) — Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occ…
    CVE-2026-57535 (CVSS 2.1) — Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. I…
    CVE-2026-13225 (CVSS 5.3) — Malicious HTML content could be injected into the email address of an order, which pretix showed without sani…
    CVE-2026-11764 (CVSS 3.6) — When creating an export of all reusable media, the secrets of connected gift cards were included in the expor…
    CVE-2026-9712 (CVSS 3.8) — When creating an export through the pretix API, API clients are returned an UUID value for their export job (…
    CVE-2026-5600 (CVSS 5.5) — A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific eve…
    CVE-2026-2452 (CVSS 7.5) — Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High