Is CVE-2025-13742 actively exploited?

No active exploitation of CVE-2025-13742 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-13742 be exploited remotely?

Yes. CVE-2025-13742 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-13742?

CVE-2025-13742 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2025-13742

MEDIUM

CVE-2025-13742

CWE-116Published: November 27, 2025· Updated: Jun 17, 2026

6.1

CVSS v3.1

Official Description

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.

NVD Source

Technical Analysis

CVE-2025-13742 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.