CVE-2026-6486 classroombookings User Display Name layout.php read cross site scripting

A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed...

CVE-2026-6486: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed...

CVE-2012-3476

Multiple cross-site scripting XSS vulnerabilities in 1 application/views/admin/layout.php and 2 themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name...

CVE-2012-3476: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 application/views/admin/layout.php and 2 themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name...

PT-2012-4745

Name of the Vulnerable Software and Affected Versions Ushahidi Platform versions prior to 2.5 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities are located in the application/views/admin/layout.php and themes/default/views/header.php files. Th...

CVE-2011-3797: Exposure of Sensitive Information to an Unauthorized Actor

ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files...

PT-2011-4690

Name of the Vulnerable Software and Affected Versions Serendipity version 1.5.5 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is demonstrated by requesting files such as templates/newspaper/layout.php, which reveals the...

CVE-2011-3800: Exposure of Sensitive Information to an Unauthorized Actor

Serendipity 1.5.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by templates/newspaper/layout.php and certain other files...

PT-2011-4628

Name of the Vulnerable Software and Affected Versions Feng Office version 1.7.2 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by accessing specific files, such as public/upgrade/templates/layout.php, which revea...

CVE-2011-3738: Exposure of Sensitive Information to an Unauthorized Actor

Feng Office 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files...

CVE-2007-5163: Improper Control of Generation of Code

PHP remote file inclusion vulnerability in includes/functions/layout.php in Nexty 1.01.A Beta allows remote attackers to execute arbitrary PHP code via a URL in the rel parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not called on a direct...