CVE-2026-6486

classroombookings User Display Name layout.php read cross site scripting

State: Published
Severity: 5.1 Medium
Published: Apr 17, 2026
Updated: Apr 18, 2026
Reserved: Apr 17, 2026

Description

A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.17.1 will fix this issue. The patch is identified as 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
classroombookingsn/a	2.0Affected 2.1Affected 2.2Affected 2.3Affected 2.4Affected 2.5Affected 2.6Affected 2.7Affected 2.8Affected 2.9Affected 2.10Affected 2.11Affected 2.12Affected 2.13Affected 2.14Affected 2.15Affected 2.16Affected 2.17.0Affected 2.17.1Not affected

References

VDB-358027 | classroombookings User Display Name layout.php read cross site scriptingvdb-entrytechnical-description
VDB-358027 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #786154 | Craig A Rodway classroombookings 2.16.4 Stored Cross-Site Scripting (XSS)third-party-advisory
https://github.com/sudo-secure/security-research/blob/main/classroombookings/stored-xss/PoC.mdexploit
https://github.com/classroombookings/classroombookings/pull/83issue-trackingpatch
https://github.com/classroombookings/classroombookings/commit/69c3c9bb8a17f1ea572d8f4502bf238f0214c98apatch
https://github.com/classroombookings/classroombookings/releases/tag/v2.17.1patch
https://github.com/classroombookings/classroombookings/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.