CVE-2026-124474mediumCWE-79

CVE-2026-124474: medium-severity vulnerability in meeting-room-booking-system mrbs-code

MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

Published

Follow this CVE+ Monitor mrbs-code

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3
MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Affected products
meeting-room-booking-system · mrbs-code
Related CVEs — meeting-room-booking-system mrbs-code

In the same product, most dangerous first.

CVE-2026-46382HIGHMeeting Room Booking System has server-side request forgery in import functionalityEPSS 0.4%CVE-2026-46688MEDIUMMeeting Room Booking System has an unauthenticated open redirectEPSS 0.4%