Search
Find a vulnerability
Search criteria
2 vulnerabilities by hrshadhin
CVE-2026-129251 (GCVE-0-2026-129251)
Vulnerability from nvd – Published: 2026-11-14 11:45 – Updated: 2026-11-14 11:45
VLAI
EPSS
VEX
Title
hrshadhin CloudSchool Event Description EventController.php cross site scripting
Summary
A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/437281 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/437281/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-129251 | third-party-advisory |
| https://vuldb.com/submit/1042948 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hrshadhin | CloudSchool |
Affected:
3.0.0
Affected: 3.0.1 cpe:2.3:a:hrshadhin:cloudschool:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hrshadhin:cloudschool:*:*:*:*:*:*:*:*"
],
"modules": [
"Event Description Handler"
],
"product": "CloudSchool",
"vendor": "hrshadhin",
"versions": [
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChetanPujari (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T11:45:19.871Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-437281 | hrshadhin CloudSchool Event Description EventController.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/437281"
},
{
"name": "VDB-437281 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/437281/cti"
},
{
"name": "CVE-2026-129251 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-129251"
},
{
"name": "Submit #1042948 | H.R. Shadhin / CloudSchool (GitHub: hrshadhin) CloudSchool v3.0.1 Stored Cross-Site Scripting (CWE-79)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1042948"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-13T20:36:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "hrshadhin CloudSchool Event Description EventController.php cross site scripting",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-129251",
"datePublished": "2026-11-14T11:45:19.871Z",
"dateReserved": "2026-11-13T19:31:40.026Z",
"dateUpdated": "2026-11-14T11:45:19.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-129251 (GCVE-0-2026-129251)
Vulnerability from cvelistv5 – Published: 2026-11-14 11:45 – Updated: 2026-11-14 11:45
VLAI
EPSS
VEX
Title
hrshadhin CloudSchool Event Description EventController.php cross site scripting
Summary
A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/437281 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/437281/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-129251 | third-party-advisory |
| https://vuldb.com/submit/1042948 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| hrshadhin | CloudSchool |
Affected:
3.0.0
Affected: 3.0.1 cpe:2.3:a:hrshadhin:cloudschool:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:hrshadhin:cloudschool:*:*:*:*:*:*:*:*"
],
"modules": [
"Event Description Handler"
],
"product": "CloudSchool",
"vendor": "hrshadhin",
"versions": [
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.0.1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ChetanPujari (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T11:45:19.871Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-437281 | hrshadhin CloudSchool Event Description EventController.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/437281"
},
{
"name": "VDB-437281 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/437281/cti"
},
{
"name": "CVE-2026-129251 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-129251"
},
{
"name": "Submit #1042948 | H.R. Shadhin / CloudSchool (GitHub: hrshadhin) CloudSchool v3.0.1 Stored Cross-Site Scripting (CWE-79)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1042948"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-11-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-11-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-11-13T20:36:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "hrshadhin CloudSchool Event Description EventController.php cross site scripting",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-129251",
"datePublished": "2026-11-14T11:45:19.871Z",
"dateReserved": "2026-11-13T19:31:40.026Z",
"dateUpdated": "2026-11-14T11:45:19.871Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}