Approved changes feed: RSS · Atom
cpe:2.3:a:pretix:venueless:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pretix (f38f81b6-9df4-59e9-8dd5-4e5f46c0ecda) |
|---|---|
| Product | Venueless (8ad70cf3-c4b7-5937-a9c2-cc22b86fa68f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-13350 |
vulnerable | 2026-07-29 00:23:32.977848 |
Details available
Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create.
Published: 2026-06-25T16:05:11.500Z
Updated: 2026-06-25T18:15:25.953Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12863 |
vulnerable | 2026-07-29 00:23:32.648533 |
Open redirect
An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.
Published: 2026-06-22T08:41:33.126Z
Updated: 2026-06-23T11:54:38.277Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12862 |
vulnerable | 2026-07-29 00:23:32.648172 |
XLSX formula injection in exports
Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.
Published: 2026-06-22T08:26:10.365Z
Updated: 2026-06-22T12:23:13.560Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-5599 |
vulnerable | 2026-06-08 08:07:03.884288 |
API allows deletion of users of other instance
A user with API access and "manage users" permission in any venueless
world is able to trigger deletion of user accounts in other worlds.
Published: 2026-04-05T12:36:27.278Z
Updated: 2026-04-06T14:33:34.105Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4982 |
vulnerable | 2026-06-08 08:07:02.749799 |
Unauthorized access to chat contents
A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature.
The exploitability is limited by the fact that the attacker needs to know the internal channel UUID of the chat channel, which is unlikely to be obtained by an outside attacker, especially for direct messages.
Published: 2026-03-27T12:32:41.164Z
Updated: 2026-03-27T19:39:20.014Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.