CVE-2026-124474 · Other
NO FIX YET · SEE WHAT TO DO
MRBS, a meeting room booking system, versions before 1.12.3 reflect the error parameter of view_entry.php without escaping it. An attacker who tricks a logged-in user into opening a crafted link can run script in that user's session, read CSRF tokens, and modify or delete bookings or perform administrative actions.
first public Nov 7, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any installation of MRBS before 1.12.3 that is reachable by staff or users who log in. Exposure depends on whether logged-in users can be lured to a crafted link; the sources do not say whether any non-default configuration is required.
Not affected if mrbs-1.12.3-or-later
Who cares mrbs, php, self-hosted
1.12.3.view_entry.php containing error= with script or HTML characters.1.12.3 or later (patch and release notes linked from the NVD entry).MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.