Skip to content
OpenAdvisories

Product · pretix

Venueless

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-82838

    Default webserver configuration with incorrect CSP

    The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.

    pretix Venueless
  • Medium 5.1
    CVE-2026-12863

    Open redirect

    An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains.

    pretix Venueless
  • Medium 5.1
    CVE-2026-12862

    XLSX formula injection in exports

    Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the user loading the file or other data in the file.

    pretix Venueless