---
id: "CVE-2026-129251"
page: "https://infrastack.ai/live/CVE-2026-129251"
kind: "vulnerability"
aliases: ["CVE-2026-129251"]
title: "CloudSchool: cross-site scripting in event description handler"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["cloudschool", "laravel", "other", "php"]
not_affected_if: ["unknown"]
published_at: "2026-11-14T12:17:44+00:00"
first_seen_at: "2026-11-14T12:28:31+00:00"
updated_at: "2026-11-14T12:30:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129251", "first_seen_at": "2026-11-14T12:28:31+00:00"}]
exploit_sources: []
---

# CloudSchool: cross-site scripting in event description handler

Link for people: https://infrastack.ai/live/CVE-2026-129251 (this .md is for agents)

CloudSchool up to 3.0.1 has a cross-site scripting flaw in the event description handler, where the data argument is not sanitised. An attacker can run script in a victim's browser session when the crafted input is viewed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the CloudSchool installation runs a version up to `3.0.1`.
- Review `app/Http/Controllers/Backend/EventController.php` for how the event description data is output.

## Timeline

- 2026-11-14T12:28:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129251

## From the sources

A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_