Skip to content
OpenAdvisories

Product · pretix

Venueless

6 known vulnerabilities.

Venueless at a glance

Last 12 months
6
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 1 vulnerability May 2026: 0 vulnerabilities June 2026: 3 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202610
Jul 202600
Jun 202630
May 202600
Apr 202610
Mar 202610
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 6.4
    CVE-2026-82838

    Default webserver configuration with incorrect CSP

    The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

    pretix Venueless
  • Low 2.3
    CVE-2026-13350

    Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't …

    pretix Venueless
  • Medium 5.1
    CVE-2026-12863

    Open redirect

    An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.

    pretix Venueless
  • Medium 5.1
    CVE-2026-12862

    XLSX formula injection in exports

    Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.

    pretix Venueless
  • High 7.3
    CVE-2026-5599

    API allows deletion of users of other instance

    A user with API access and "manage users" permission in any venueless world is able to trigger deletion of user accounts in other worlds.

    pretix Venueless
  • High 7.3
    CVE-2026-4982

    Unauthorized access to chat contents

    A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or channels in other worlds on the same server due to a bug in the reporting feature. The exploitability is limited by the fact that the atta…

    pretix Venueless