CVE-2026-6486

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-6486

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6486.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-6486

Published

2026-04-17T12:15:14.036Z

Modified

2026-08-04T11:51:18.115322075Z

Severity

2.0 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

classroombookings User Display Name layout.php read cross site scripting

Details

A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 2.17.1 will fix this issue. The patch is identified as 69c3c9bb8a17f1ea572d8f4502bf238f0214c98a. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6486.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.7"
                },
                {
                    "last_affected": "2.7"
                },
                {
                    "introduced": "2.8"
                },
                {
                    "last_affected": "2.8"
                },
                {
                    "introduced": "2.9"
                },
                {
                    "last_affected": "2.9"
                },
                {
                    "introduced": "2.10"
                },
                {
                    "last_affected": "2.10"
                },
                {
                    "introduced": "2.11"
                },
                {
                    "last_affected": "2.11"
                },
                {
                    "introduced": "2.12"
                },
                {
                    "last_affected": "2.12"
                },
                {
                    "introduced": "2.13"
                },
                {
                    "last_affected": "2.13"
                },
                {
                    "introduced": "2.14"
                },
                {
                    "last_affected": "2.14"
                },
                {
                    "introduced": "2.15"
                },
                {
                    "last_affected": "2.15"
                },
                {
                    "introduced": "2.16"
                },
                {
                    "last_affected": "2.16"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ]
}

References

Affected packages

Git / github.com/classroombookings/classroombookings

Affected ranges

Type

GIT

Repo

https://github.com/classroombookings/classroombookings

Events

Introduced

8d1a7e1091fad59766ee1545e150ca60d2076bea

Last affected

b5d26e71fd28a5eca6c8ad8095140a19bc85c487

Database specific

{
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.1"
        },
        {
            "last_affected": "2.1"
        },
        {
            "introduced": "2.2"
        },
        {
            "last_affected": "2.2"
        },
        {
            "introduced": "2.3"
        },
        {
            "last_affected": "2.3"
        },
        {
            "introduced": "2.4"
        },
        {
            "last_affected": "2.4"
        },
        {
            "introduced": "2.5"
        },
        {
            "last_affected": "2.5"
        },
        {
            "introduced": "2.6"
        },
        {
            "last_affected": "2.6"
        },
        {
            "introduced": "2.17.0"
        },
        {
            "last_affected": "2.17.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

2.*

2.0

2.1

2.17.0

2.2

2.3

2.4

2.5

2.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6486.json"