CVE-2026-124474

Name of the Vulnerable Software and Affected Versions MRBS (Meeting Room Booking System) versions prior to 1.12.3

Description A reflected cross-site scripting issue exists where unauthenticated attackers can inject scripts through the error parameter of the 'view entry.php' endpoint. This allows attackers to send crafted links to authenticated users to steal CSRF (Cross-Site Request Forgery) tokens—which are unique identifiers used to prevent unauthorized commands—modify or delete bookings, or execute administrative actions.

Recommendations Update to version 1.12.3 or later. As a temporary mitigation, restrict access to the 'view entry.php' endpoint or avoid using the error parameter.