CVE-2026-129133

The Meeting Room Booking System (MRBS) version before 1.13.0 is vulnerable to a CSV formula injection vulnerability in the web/report.php component. The root cause is that the escape() function fails to neutralize leading formula characters, allowing authenticated users to inject malicious formul...

EUVD-2026-125546

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fiel...

PT-2026-146991

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fiel...