EUVD-2026-23415
GHSA-376w-pjjp-jrvj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
10DescriptionCVE.org
A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.17.1 will fix this issue. The patch is identified as 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Stored cross-site scripting (XSS) in Classroom Bookings up to version 2.17.0 allows authenticated users to inject malicious scripts via the displayname parameter in the User Display Name Handler component, resulting in arbitrary script execution in other users' browsers. The vulnerability requires user interaction (victim must view the affected page) and authenticated access, limiting immediate risk, but publicly available exploit code and vendor confirmation of the issue increase real-world threat. Upgrading to version 2.17.1 resolves the vulnerability.
Technical ContextAI
The vulnerability exists in the layout.php file within crbs-core/application/views, which handles rendering of user display names. The User Display Name Handler component fails to properly sanitize or escape the displayname parameter before outputting it to HTML, violating CWE-79 (Improper Neutralization of Input During Web Page Generation). Because Classroom Bookings is a PHP-based web application for educational room booking management, the displayname field is typically user-controlled and rendered in multiple places throughout the interface. The lack of output encoding allows attackers to inject arbitrary JavaScript that executes in the security context of other authenticated users viewing pages containing the poisoned displayname value.
RemediationAI
Upgrade Classroom Bookings to version 2.17.1 or later immediately, which includes commit 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a that properly sanitizes displayname inputs. The upgrade is straightforward via the vendor's GitHub releases page (https://github.com/classroombookings/classroombookings/releases/tag/v2.17.1). If immediate upgrade is not feasible, implement a temporary workaround by restricting access to Classroom Bookings to trusted users only (via IP whitelist, VPN, or authentication gateway) to reduce the likelihood of successful exploitation while patch testing occurs. This mitigation trades ease of access for security but is acceptable short-term. Additionally, audit the displayname fields in the database for any suspicious script content using regex patterns like '<script' or 'javascript:' to detect if exploitation has already occurred. Apply content security policy (CSP) headers with script-src 'self' to provide defense-in-depth, though this does not replace the patch. Remove or disable any admin accounts not in active use to minimize the attack surface for credential compromise that would precede exploitation.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today