CVE-2026-129251 · Other
NO FIX YET
CloudSchool up to 3.0.1 has a cross-site scripting flaw in the event description handler, where the data argument is not sanitised. An attacker can run script in a victim's browser session when the crafted input is viewed.
first public Nov 14, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sources only name CloudSchool up to 3.0.1 and the event description controller in app/Http/Controllers/Backend/EventController.php; the exposure path beyond that is unknown. Teams running CloudSchool self-hosted at these versions should look at that controller. The sources do not say whether a fixed version exists.
Not affected if unknown
Who cares cloudschool, laravel, php
3.0.1.app/Http/Controllers/Backend/EventController.php for how the event description data is output.No fix yet, per the sources.
A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.