Unrated severityNVD Advisory· Published Jun 25, 2026· Updated Jun 25, 2026
Stored XSS in ticket confirmation page
CVE-2026-13225
Description
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.