Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
41 results
Oct 28, 2026When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` reqCVE-2026-101274 · Other software · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.9
When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.CVE-2026-101271 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.1
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026Malicious HTML content could be injected into the help texts of various fields with organizer permissions.CVE-2026-101270 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.1
Malicious HTML content could be injected into the help texts of various fields with organizer permissions.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-basedCVE-2026-101269 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.3
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account.CVE-2026-101268 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 1.7
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information.CVE-2026-101267 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.7
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2026A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.CVE-2026-101266 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 1.3
A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2026The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content.CVE-2026-82838 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.4
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
- Product
- venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026Our payment integration with GiroCheckout did not properly validate payment status responses.CVE-2026-18029 · Other software · pretix GmbH · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.3
Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
- Product
- pretix-girosolution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks.CVE-2026-18028 · Other software · pretix GmbH · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.3
The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed request to create products, quotas, set bank transfer configuration, or connect a stripe account to an event they do not have access to.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * CVE-2026-13602 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 7.7
We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconnect, pretix-sofort, and pretix-saferpay contain a code path that is intended for the transport of session parameters from a tab with isolated cookies (e.g. in the pretix widget) to a new tab. For this purpose, a set of session parameters is cryptographically signed and then passed to the new tab as a URL parameter. The plugins perform no further validation of the session parameters, other than the cryptographic signature being valid. This is fixed with the releases issued today by strictly validating that no session parameters outside of the scope of the respective plugin may be set. * An unrelated feature in the core system is used to generate redirect links that obfuscate any Referer headers for outgoing links to prevent leakage of secrets in URLs. This redirect page also requires cryptographically signed parameters. Unfortunately, it uses the same key and
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 1, 2026The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology.CVE-2026-13603 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Critical 9
The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the payment provider back to our system with a query parameter like ?resourcePath=/v1/checkouts/{checkoutId}/payment in the URL. Our system is then supposed to fetch the status of the transaction from the URL given by baseUrl + resourcePath. Our plugin pretix-oppwa did so insecurely by concatenating the parameter form the URL to the base domain of the API without further validation and, critically, without a / at the end of the baseUrl. Therefore, an attacker could inject a resourcePath argument in a way that causes pretix to call a different server instead. Since the request includes the access token (API key) of the Oppwa account, this would leak the access token, giving access to data contained in the payment provider's system. This is fixed with the release today by strictly validating the given API URL. After installing the update, we recommend asking your payment provider for a new access to
- Product
- pretix-oppwa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.CVE-2026-13350 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.3
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
- Product
- Venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Our payment integration with Mollie did not properly validate payment status responses.CVE-2026-57536 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.3
Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
- Product
- pretix-mollie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags.CVE-2026-57535 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.1
Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src attribute of these images pointed to an URL, the PDF rendering engine would download the image from that place and display it, thereby leaking information about the rendering server and possibly creating an SSRF vector in the local network.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.CVE-2026-57534 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.1
Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.
- Product
- pretix-pages
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs.CVE-2026-57533 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.1
Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since this page has a Content-Security-Policy, this can mainly be used for phishing purposes.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser.CVE-2026-57532 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 8.8
Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF editor is opened in the browser. This could allow one backend user to inject JavaScript into the browser context of another backend user. Due to requirements of the PDF rendering and editing libraries used, this is one of the few pages in our backend that do not have a strong Content-Security-Policy that would render this capability useless for most scenarios.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.CVE-2026-13314 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2
Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.
- Product
- pretix-digital
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual CVE-2026-13225 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 5.3
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Our payment integration with Computop-based payment methods did not properly validate payment status responses.CVE-2026-13223 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.3
Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
- Product
- pretix-computop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2026Our payment integration with Oppwa-based payment methods did not properly validate payment status responses.CVE-2026-13222 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 6.3
Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
- Product
- pretix-oppwa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.CVE-2026-12863 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 5.1
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.
- Product
- Venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2026Untrusted user data was passed verbatim to Excel exports for administrators.CVE-2026-12862 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 5.1
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
- Product
- Venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not hCVE-2026-11764 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 3.6
When creating an export of all reusable media, the secrets of connected gift cards were included in the export even if the user creating the export does not have permission to view gift cards. This is inconsistent with the UI and API where only the first letters of the gift card secret are shown. Therefore, it allows circumventing a permission boundary.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839CVE-2026-9712 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 3.8
When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, random string like 35742818-c375-4d15-839f-d49aecce94d6). Using this UUID, the API client can then request the actual file for download. The same kind of UUID is used in other places in pretix when temporary files are generated for internal use or download. One remaining API endpoint, however, wrongfully did not verify if the UUID used for download actually belongs to a file that is supposed to be downloadable and belongs to the correct user. In reality, this is hard to exploit because an attacker would need to have access to a valid UUID for the file they desire which is unlikely to happen without a separate security problem giving them access to logs etc.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 8, 2026A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging CVE-2026-5600 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Medium 5.5
A new API endpoint introduced in pretix 2025 that is supposed to return all check-in events of a specific event in fact returns all check-in events belonging to the respective organizer. This allows an API consumer to access information for all other events under the same organizer, even those they should not have access to. These records contain information on the time and result of every ticket scan as well as the ID of the matched ticket. Example: { "id": 123, "successful": true, "error_reason": null, "error_explanation": null, "position": 321, "datetime": "2020-08-23T09:00:00+02:00", "list": 456, "created": "2020-08-23T09:00:00+02:00", "auto_checked_in": false, "gate": null, "device": 1, "device_id": 1, "type": "entry" } An unauthorized user usually has no way to match these IDs (position) back to individual people.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2026A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.CVE-2026-5599 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 7.3
A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.
- Product
- Venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same seCVE-2026-4982 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 7.3
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.
- Product
- Venueless
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026Emails sent by pretix can utilize placeholders that will be filled with customer data.CVE-2026-2452 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 7.5
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}. This way, an attacker with the ability to control email templates (usually every user of the pretix backend) could retrieve sensitive information from the system configuration, including even database passwords or API keys. pretix does include mechanisms to prevent the usage of such malicious placeholders, however due to a mistake in the code, they were not fully effective for this plugin. Out of caution, we recommend that you rotate all passwords and API keys contained in your pretix.cfg https://docs.pretix.eu/self-hosting/config/ file.
- Product
- pretix-newsletter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026Emails sent by pretix can utilize placeholders that will be filled with customer data.CVE-2026-2451 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 7.5
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained a security-relevant bug: It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}. This way, an attacker with the ability to control email templates (usually every user of the pretix backend) could retrieve sensitive information from the system configuration, including even database passwords or API keys. pretix does include mechanisms to prevent the usage of such malicious placeholders, however due to a mistake in the code, they were not fully effective for this plugin. Out of caution, we recommend that you rotate all passwords and API keys contained in your pretix.cfg file.
- Product
- pretix-doistep
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 16, 2026Emails sent by pretix can utilize placeholders that will be filled with customer data.CVE-2026-2415 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 7.5
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. This mechanism contained two security-relevant bugs: * It was possible to exfiltrate information about the pretix system through specially crafted placeholder names such as {{event.__init__.__code__.co_filename}}. This way, an attacker with the ability to control email templates (usually every user of the pretix backend) could retrieve sensitive information from the system configuration, including even database passwords or API keys. pretix does include mechanisms to prevent the usage of such malicious placeholders, however due to a mistake in the code, they were not fully effective for the email subject. * Placeholders in subjects and plain text bodies of emails were wrongfully evaluated twice. Therefore, if the first evaluation of a placeholder again contains a placeholder, this second placeholder was rendered. This allows the rendering of placeholders controlled by the ticket buyer, and therefore the exploitation of the first issue as a ticket buye
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.CVE-2025-14882 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 3.8
An API endpoint allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
- Product
- pretix-offlinesales
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2025Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.CVE-2025-14881 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 3.8
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Emails sent by pretix can utilize placeholders that will be filled with customer data.CVE-2025-13742 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6Low 2.4
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2024pretix Widget: Local File InclusionCVE-2024-9575 · WordPress plugins & themes · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 8.5
Local File Inclusion vulnerability in pretix Widget WordPress plugin pretix-widget on Windows allows PHP Local File Inclusion. This issue affects pretix Widget WordPress plugin: from 1.0.0 through 1.0.5.
- Product
- pretix Widget
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update pretix Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compretix.eu
Aug 23, 2024Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page.CVE-2024-8113 · Other software · pretix · reported by 655498c3-6ec5-4f0b-aea6-853b334d05a6High 7.2
Stored XSS in organizer and event settings of pretix up to 2024.7.0 allows malicious event organizers to inject HTML tags into e-mail previews on settings page. The default Content Security Policy of pretix prevents execution of attacker-provided scripts, making exploitation unlikely. However, combined with a CSP bypass (which is not currently known) the vulnerability could be used to impersonate other organizers or staff users.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2024pretix before 2024.1.1 mishandles file validation.CVE-2024-27447 · Other software · rami · reported by MITRECritical 9.8
pretix before 2024.1.1 mishandles file validation.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2023An issue was discovered in pretix before 2023.7.1.CVE-2023-44463 · Other software · Rami · reported by MITREMedium 5.3
An issue was discovered in pretix before 2023.7.1. Incorrect parsing of configuration files causes the application to trust unchecked X-Forwarded-For headers even though it has not been configured to do so. This can lead to IP address spoofing by users of the application.
- Product
- Pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2023pretix before 2023.7.2 allows Pillow to parse EPS files.CVE-2023-44464 · Other software · rami · reported by MITREHigh 7.8
pretix before 2023.7.2 allows Pillow to parse EPS files.
- Product
- pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session.CVE-2023-27891 · Other software · Rami · reported by MITREHigh 7.5
rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.
- Product
- Pretix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.