This vulnerability is a reflected cross‑site scripting flaw found in the error parameter of the view_entry.php page. It enables unauthenticated attackers to inject arbitrary scripts via a crafted URL. When a logged‑in user clicks such a link, the injected script executes in the user’s browser, allowing the attacker to read CSRF tokens, modify or delete bookings, or perform administrative actions by exploiting the user’s authenticated session.

The flaw affects the Meeting Room Booking System (MRBS) codebase prior to version 1.12.3. Any installation running a version older than 1.12.3 is vulnerable; the fix is included in the 1.12.3 release and subsequent point releases.

The CVSS score of 5.3 indicates a moderate risk; the EPSS score is not available, so the current exploitation likelihood is uncertain, but the vulnerability can be triggered via a simple crafted URL sent to users. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the issue without authentication by deceiving users into visiting malicious links, making the threat straightforward for social‑engineering attacks. The potential impact includes unauthorized booking manipulation and administrative privilege escalation based on the victim’s session.