EUVD-2026-125547

MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the...

CVE-2026-129132

The MRBS application (versions before 1.13.0 ) is vulnerable to an LDAP injection in web/lib/MRBS/Auth/AuthLdap.php. The root cause is the interpolation of unescaped login usernames into DN search and group-membership filters. This allows attackers with valid directory credentials but without the...

CVE-2026-129133

The Meeting Room Booking System (MRBS) version before 1.13.0 is vulnerable to a CSV formula injection vulnerability in the web/report.php component. The root cause is that the escape() function fails to neutralize leading formula characters, allowing authenticated users to inject malicious formul...

EUVD-2026-125546

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fiel...

EUVD-2026-125545

MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $urlbase is unset. Attackers can request a reset for a victim so AuthDb::notifyUser emails a link pointing to their host, capturing th...

CVE-2026-129134

Versions of MRBS before 1.13.0 are vulnerable to a password reset poisoning vulnerability caused by a Host header injection . When the $url_base variable is unset, unauthenticated attackers can forge the Host header to redirect password reset links to a malicious host. This allows an attacker to ...

PT-2026-146992

MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect reset links by forging the Host header when $url base is unset. Attackers can request a reset for a victim so AuthDb::notifyUser emails a link pointing to their host, capturing t...

PT-2026-146991

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fiel...

PT-2026-146990

MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the...

CVE-2026-124474

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124474 MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

EUVD-2026-119606

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124474

The Meeting Room Booking System (MRBS) version before 1.12.3 is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The issue resides in the view_entry.php file, where an unauthenticated attacker can inject scripts via the error parameter . By sending crafted links to authenticate...

CVE-2026-124474 MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124474: meeting-room-booking-system mrbs-code: MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows…

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

PT-2026-140010

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete...

CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

EUVD-2026-57701

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382 Meeting Room Booking System has server-side request forgery in import functionality

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

EUVD-2026-57700

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...