CVE-2026-129251
Deferred Deferred - Pending Action

Cross-Site Scripting in hrshadhin CloudSchool

Publication date: 2026-11-14

Last updated on: 2026-11-14

Assigner: VulDB

Description
A vulnerability was detected in hrshadhin CloudSchool up to 3.0.1. This affects an unknown function of the file app/Http/Controllers/Backend/EventController.php of the component Event Description Handler. The manipulation of the argument data results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-14
Last Modified
2026-11-14
Generated
2026-11-15
AI Q&A
2026-11-14
EPSS Evaluated
N/A
NVD
CVE-2026-129251
EUVD
EUVD-2026-125899

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hrshadhin CloudSchool 3.0.0
hrshadhin CloudSchool 3.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in hrshadhin CloudSchool up to version 3.0.1. It exists in the EventController.php file where the data argument is manipulated, allowing malicious scripts to be executed in a user's browser. The attack can be launched remotely and the exploit is publicly available.

Detection Guidance

This vulnerability involves a cross-site scripting (XSS) flaw in hrshadhin CloudSchool up to version 3.0.1, specifically in the EventController.php file. Detection may involve inspecting web application inputs for suspicious scripts or reviewing server logs for unusual activity related to the Event Description Handler component.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts into web pages viewed by users. This may lead to theft of session cookies, account takeover, or defacement of the website. Users with access to the affected system could have their interactions compromised.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to user data, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. It may result in data breaches, unauthorized disclosure, or loss of data integrity.

Mitigation Strategies

Immediate mitigation steps include updating hrshadhin CloudSchool to the latest version beyond 3.0.1 if available, applying input validation and output encoding to prevent XSS attacks, and monitoring network traffic for signs of exploitation. Since the vendor did not respond, consider isolating affected systems if updates are unavailable.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...