cve.bz

meeting-room-booking-system mrbs-code vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 8.6CVE-2026-129134

    MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url_base is unset. Attackers can request a reset for a victim so AuthDb::no…

  2. 5.1CVE-2026-129133

    MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape() function in web/report.php fails to neutralize leading formula characters. Attackers can …

  3. 2.3CVE-2026-129132

    MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the r…

  4. 5.3CVE-2026-124474EPSS 0.2%

    MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to …

  5. 6.9CVE-2026-46688EPSS 0.4%

    The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to cre…

  6. 8.7CVE-2026-46382EPSS 0.4%

    The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known worka…