CVE-2026-124474: MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php
MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.
Event History
Frequently Asked Questions
Who is exposed to this issue?
MRBS deployments running a version before 1.12.3 are affected. Exploitation targets users who are already logged in, including users with administrative privileges.
What must an attacker do to exploit it?
An unauthenticated attacker must send a crafted link that supplies malicious script through the error parameter of view_entry.php. A logged-in user must then open that link.
What could happen if a logged-in user opens a crafted link?
The injected script can read CSRF tokens and act in the victim's session. This may allow bookings to be modified or deleted, or administrative actions to be performed when the victim has sufficient privileges.
How can I determine whether my deployment is affected?
Check the installed MRBS version. Versions before 1.12.3 are affected; version 1.12.3 is identified in the provided release reference as the fixed release.