PT-2026-51290 · Pretix · Venueless

Rokkam Vamshi · Published 2026-06-22 · Updated 2026-06-22 · CVE-2026-12862

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description Untrusted user data is passed verbatim to Excel exports for administrators. This allows formula injection, a technique where an attacker inserts malicious formulas into a spreadsheet, which can be used to compromise the environment of the user loading the file or access other data within the file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-148

Related Identifiers

CVE-2026-12862

Affected Products

Venueless

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-12862 · Security Note
• https://github.com/venueless/venueless/security/advisories/GHSA-5hw3-655h-7m86 · Note
• https://twitter.com/VulmonFeeds/status/2069013113257484415 · Twitter Post