| タイトル | Craig A Rodway classroombookings 2.16.4 Stored Cross-Site Scripting (XSS) |
|---|
| 説明 | A stored cross-site scripting (XSS) vulnerability in Classroom Bookings v2.16.4 allows authenticated users with the Teacher role to inject arbitrary JavaScript via the Display Name field in the profile settings. The malicious payload is stored and executed when the affected data is rendered, leading to execution of attacker-controlled scripts in other users’ browsers. |
|---|
| ソース | ⚠️ https://github.com/sudo-secure/security-research/blob/main/classroombookings/stored-xss/PoC.md |
|---|
| ユーザー | sudosme (UID 96548) |
|---|
| 送信 | 2026年03月23日 13:54 (7 月 ago) |
|---|
| モデレーション | 2026年04月17日 08:58 (25 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 358027 [classroombookings 迄 2.17.0 User Display Name layout.php read displayname クロスサイトスクリプティング] |
|---|
| ポイント | 18 |
|---|