GHSA-5wqw-q7gh-j65v: MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

Q: Who is exposed to this issue?

MRBS deployments running a version before 1.12.3 are affected. Exploitation targets users who are already logged in to MRBS and open an attacker-crafted link.

Q: What does an attacker need to exploit it?

The attacker does not need to authenticate to inject script through the error parameter of view_entry.php. They do need to convince a logged-in user to visit a crafted URL.

Q: What could an attacker do in a successful attack?

Injected script can read CSRF tokens in the victim's session. It can then modify or delete bookings, and may perform administrative actions available to the targeted user.

Q: How can this be remediated?

Upgrade MRBS to version 1.12.3 or later. The issue affects versions before 1.12.3.

Published Nov 8, 2026

Updated

MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.

Affected Software

1 affected component

MRBS Meeting Room Booking System<1.12.3

Event History

Nov 8, 2026

CVE Published

via OSV·01:52 PM

Data Sourced

via OSV·01:52 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

MRBS deployments running a version before 1.12.3 are affected. Exploitation targets users who are already logged in to MRBS and open an attacker-crafted link.

What does an attacker need to exploit it?

The attacker does not need to authenticate to inject script through the error parameter of view_entry.php. They do need to convince a logged-in user to visit a crafted URL.

What could an attacker do in a successful attack?

Injected script can read CSRF tokens in the victim's session. It can then modify or delete bookings, and may perform administrative actions available to the targeted user.

How can this be remediated?

Upgrade MRBS to version 1.12.3 or later. The issue affects versions before 1.12.3.

GHSA-5wqw-q7gh-j65v: MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker do in a successful attack?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What could an attacker do in a successful attack?

How can this be remediated?