{"id":"CVE-2026-129251","kind":"vulnerability","aliases":["CVE-2026-129251"],"related":[],"title":"CloudSchool: cross-site scripting in event description handler","description":"A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"CloudSchool up to 3.0.1 has a cross-site scripting flaw in the event description handler, where the data argument is not sanitised. An attacker can run script in a victim's browser session when the crafted input is viewed.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloudschool","laravel","other","php"],"not_affected_if":["unknown"],"how_to_check":"- Check whether the CloudSchool installation runs a version up to `3.0.1`.\n- Review `app/Http/Controllers/Backend/EventController.php` for how the event description data is output.","fix":null,"status":"open","published_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","triaged_at":"2026-11-14T12:30:28+00:00","updated_at":"2026-11-14T12:30:28+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-14T12:30:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"CloudSchool: cross-site scripting in event description handler","impact":"low","summary":"CloudSchool up to 3.0.1 has a cross-site scripting flaw in the event description handler, where the data argument is not sanitised. An attacker can run script in a victim's browser session when the crafted input is viewed.","audience":"businesses","category":"other","nicknames":[],"who_cares":["cloudschool","php","laravel"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in users' browsers, session data exposed","analyst_note":"Confirm the affected versions, whether the flaw needs a backend login, and whether a fix exists; the NVD entry is at https://nvd.nist.gov/vuln/detail/CVE-2026-129251.","how_to_check":"- Check whether the CloudSchool installation runs a version up to `3.0.1`.\n- Review `app/Http/Controllers/Backend/EventController.php` for how the event description data is output.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sources only name CloudSchool up to 3.0.1 and the event description controller in app/Http/Controllers/Backend/EventController.php; the exposure path beyond that is unknown. Teams running CloudSchool self-hosted at these versions should look at that controller. The sources do not say whether a fixed version exists.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000731,"input_tokens":4586,"output_tokens":544,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-129251':12A,15A '-2026':11A,14A '3.0.1':23B,69C 'affect':71C 'app/http/controllers/backend/eventcontroller.php':78C 'argument':39B,89C 'attack':44B,102C 'browser':52B 'cloudschool':1A,16B,20B,66C 'compon':81C 'contact':116C 'craft':56B 'cross':3A,27B,93C 'cross-sit':2A,26B 'cve':10A,13A 'data':38B,90C 'descript':8A,34B,83C 'detect':63C 'disclosur':120C 'earli':117C 'event':7A,33B,82C 'exploit':105C 'file':77C 'flaw':30B 'function':74C 'handler':9A,35B,84C 'hrshadhin':65C 'input':57B 'laravel':17B 'launch':100C 'manipul':86C 'may':110C 'php':19B 'possibl':98C 'public':108C 'remot':103C 'respond':124C 'result':91C 'run':46B 'sanitis':42B 'script':5A,29B,47B,95C 'session':53B 'site':4A,28B,94C 'unknown':73C 'use':112C 'vendor':114C 'victim':50B 'view':59B 'vulner':61C 'way':127C","nicknames":[],"mitigations":[],"who_affected":"Sources only name CloudSchool up to 3.0.1 and the event description controller in app/Http/Controllers/Backend/EventController.php; the exposure path beyond that is unknown. Teams running CloudSchool self-hosted at these versions should look at that controller. The sources do not say whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cloudschool","laravel","low","other","php"],"campaign_type":null,"search_a":"'-129251':12A,15A '-2026':11A,14A 'cloudschool':1A 'cross':3A 'cross-sit':2A 'cve':10A,13A 'descript':8A 'event':7A 'handler':9A 'script':5A 'site':4A","search_b":"'3.0.1':23B 'argument':39B 'attack':44B 'browser':52B 'cloudschool':16B,20B 'craft':56B 'cross':27B 'cross-sit':26B 'data':38B 'descript':34B 'event':33B 'flaw':30B 'handler':35B 'input':57B 'laravel':17B 'php':19B 'run':46B 'sanitis':42B 'script':29B,47B 'session':53B 'site':28B 'victim':50B 'view':59B","search_c":"'3.0.1':69C 'affect':71C 'app/http/controllers/backend/eventcontroller.php':78C 'argument':89C 'attack':102C 'cloudschool':66C 'compon':81C 'contact':116C 'cross':93C 'data':90C 'descript':83C 'detect':63C 'disclosur':120C 'earli':117C 'event':82C 'exploit':105C 'file':77C 'function':74C 'handler':84C 'hrshadhin':65C 'launch':100C 'manipul':86C 'may':110C 'possibl':98C 'public':108C 'remot':103C 'respond':124C 'result':91C 'script':95C 'site':94C 'unknown':73C 'use':112C 'vendor':114C 'vulner':61C 'way':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T12:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129251","severity":null,"published_at":"2026-11-14T12:17:44+00:00","modified_at":"2026-11-14T12:17:44+00:00","first_seen_at":"2026-11-14T12:28:31+00:00","fetched_at":"2026-11-14T12:28:31+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}