CVE-2026-6486

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6486", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-17T06:58:13.000Z", "datePublished": "2026-04-17T12:15:14.036Z", "dateUpdated": "2026-04-18T02:58:17.041Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-17T12:15:14.036Z"}, "title": "classroombookings User Display Name layout.php read cross site scripting", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-79", "lang": "en", "description": "Cross Site Scripting"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "Code Injection"}]}], "affected": [{"vendor": "n/a", "product": "classroombookings", "versions": [{"version": "2.0", "status": "affected"}, {"version": "2.1", "status": "affected"}, {"version": "2.2", "status": "affected"}, {"version": "2.3", "status": "affected"}, {"version": "2.4", "status": "affected"}, {"version": "2.5", "status": "affected"}, {"version": "2.6", "status": "affected"}, {"version": "2.7", "status": "affected"}, {"version": "2.8", "status": "affected"}, {"version": "2.9", "status": "affected"}, {"version": "2.10", "status": "affected"}, {"version": "2.11", "status": "affected"}, {"version": "2.12", "status": "affected"}, {"version": "2.13", "status": "affected"}, {"version": "2.14", "status": "affected"}, {"version": "2.15", "status": "affected"}, {"version": "2.16", "status": "affected"}, {"version": "2.17.0", "status": "affected"}, {"version": "2.17.1", "status": "unaffected"}], "cpes": ["cpe:2.3:a:classroombookings:classroombookings:*:*:*:*:*:*:*:*"], "modules": ["User Display Name Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.17.1 will fix this issue. The patch is identified as 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-04-17T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-17T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-17T09:03:23.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "sudosme (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/358027", "name": "VDB-358027 | classroombookings User Display Name layout.php read cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358027/cti", "name": "VDB-358027 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/786154", "name": "Submit #786154 | Craig A Rodway classroombookings 2.16.4 Stored Cross-Site Scripting (XSS)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sudo-secure/security-research/blob/main/classroombookings/stored-xss/PoC.md", "tags": ["exploit"]}, {"url": "https://github.com/classroombookings/classroombookings/pull/83", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/classroombookings/classroombookings/commit/69c3c9bb8a17f1ea572d8f4502bf238f0214c98a", "tags": ["patch"]}, {"url": "https://github.com/classroombookings/classroombookings/releases/tag/v2.17.1", "tags": ["patch"]}, {"url": "https://github.com/classroombookings/classroombookings/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-18T02:57:55.318441Z", "id": "CVE-2026-6486", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-18T02:58:17.041Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6486", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-18T02:57:55.318441Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-18T02:58:05.502Z"}}], "cna": {"tags": ["x_open-source"], "title": "classroombookings User Display Name layout.php read cross site scripting", "credits": [{"lang": "en", "type": "reporter", "value": "sudosme (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.5, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:classroombookings:classroombookings:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["User Display Name Handler"], "product": "classroombookings", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.6"}, {"status": "affected", "version": "2.7"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.9"}, {"status": "affected", "version": "2.10"}, {"status": "affected", "version": "2.11"}, {"status": "affected", "version": "2.12"}, {"status": "affected", "version": "2.13"}, {"status": "affected", "version": "2.14"}, {"status": "affected", "version": "2.15"}, {"status": "affected", "version": "2.16"}, {"status": "affected", "version": "2.17.0"}, {"status": "unaffected", "version": "2.17.1"}]}], "timeline": [{"lang": "en", "time": "2026-04-17T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-17T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-17T09:03:23.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/358027", "name": "VDB-358027 | classroombookings User Display Name layout.php read cross site scripting", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358027/cti", "name": "VDB-358027 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/786154", "name": "Submit #786154 | Craig A Rodway classroombookings 2.16.4 Stored Cross-Site Scripting (XSS)", "tags": ["third-party-advisory"]}, {"url": "https://github.com/sudo-secure/security-research/blob/main/classroombookings/stored-xss/PoC.md", "tags": ["exploit"]}, {"url": "https://github.com/classroombookings/classroombookings/pull/83", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/classroombookings/classroombookings/commit/69c3c9bb8a17f1ea572d8f4502bf238f0214c98a", "tags": ["patch"]}, {"url": "https://github.com/classroombookings/classroombookings/releases/tag/v2.17.1", "tags": ["patch"]}, {"url": "https://github.com/classroombookings/classroombookings/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.17.1 will fix this issue. The patch is identified as 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross Site Scripting"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "Code Injection"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-17T12:15:14.036Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6486", "state": "PUBLISHED", "dateUpdated": "2026-04-18T02:58:17.041Z", "dateReserved": "2026-04-17T06:58:13.000Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-17T12:15:14.036Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:classroombookings:classroombookings:*:*:*:*:*:*:*:*"], "modules": ["User Display Name Handler"], "product": "classroombookings", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}, {"status": "affected", "version": "2.2"}, {"status": "affected", "version": "2.3"}, {"status": "affected", "version": "2.4"}, {"status": "affected", "version": "2.5"}, {"status": "affected", "version": "2.6"}, {"status": "affected", "version": "2.7"}, {"status": "affected", "version": "2.8"}, {"status": "affected", "version": "2.9"}, {"status": "affected", "version": "2.10"}, {"status": "affected", "version": "2.11"}, {"status": "affected", "version": "2.12"}, {"status": "affected", "version": "2.13"}, {"status": "affected", "version": "2.14"}, {"status": "affected", "version": "2.15"}, {"status": "affected", "version": "2.16"}, {"status": "affected", "version": "2.17.0"}, {"status": "unaffected", "version": "2.17.1"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.17.1 will fix this issue. The patch is identified as 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}], "id": "CVE-2026-6486", "lastModified": "2026-06-17T11:00:52.210", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.0, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6486", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-18T02:57:55.318441Z", "version": "2.0.3"}}]}, "published": "2026-04-17T13:16:14.117", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/classroombookings/classroombookings/"}, {"source": "cna@vuldb.com", "url": "https://github.com/classroombookings/classroombookings/commit/69c3c9bb8a17f1ea572d8f4502bf238f0214c98a"}, {"source": "cna@vuldb.com", "url": "https://github.com/classroombookings/classroombookings/pull/83"}, {"source": "cna@vuldb.com", "url": "https://github.com/classroombookings/classroombookings/releases/tag/v2.17.1"}, {"source": "cna@vuldb.com", "url": "https://github.com/sudo-secure/security-research/blob/main/classroombookings/stored-xss/PoC.md"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/786154"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358027"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358027/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-94"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.17.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.17.1"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "classroombookings", "source": "cna", "vendor": "n/a"}, "product": "classroombookings", "vendor": "classroombookings"}], "analysis": {"en": {"generated_at": "2026-04-18T17:14:08.793073+00:00", "value": {"mitigation_remediation": ["Upgrade ClassRoomBookings to version 2.17.1 or later, which includes the patch identified by commit 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a.", "Implement server\u2011side validation on the displayname field to allow only safe characters (e.g., alphanumerics and limited punctuation) to mitigate input\u2011based XSS (CWE\u201179).", "Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted domains, reducing the impact of any remaining XSS payloads."], "summary": {"action": "Patch", "impact": "Client\u2011side cross\u2011site scripting in the User Display Name handler"}, "threat_synthesis": {"affected_systems": "ClassRoomBookings, versions up to and including 2.17.0, including 2.17.0 and earlier releases. The issue is fixed in the 2.17.1 release; no other affected versions are reported.", "description_and_impact": "The vulnerability allows an attacker to supply a malicious displayname value that is reflected unsanitized into the layout template, resulting in client\u2011side cross\u2011site scripting (CWE\u201179). The attack injects arbitrary JavaScript which, when executed in the victim\u2019s browser, can steal credentials, deface the page, or perform other browser\u2011based actions. It is a stored or reflected XSS rather than a server\u2011side code execution flaw (CWE\u201194 is listed but not a primary exploitation path).", "risk_and_exploitability": "The CVSS score is 5.1, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA\u2019s KEV catalog. The attack vector is remote, requiring only that an attacker be able to influence the displayname argument sent to the application. An attacker can craft a exploit that targets any user who loads the affected page, potentially compromising user sessions or the integrity of the viewed content."}}}}, "created": "2026-04-17T13:30:19.432200+00:00", "updated": "2026-04-18T17:15:05.788288+00:00", "vendors": ["classroombookings", "classroombookings$PRODUCT$classroombookings"]}