https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 09:01:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-39338 <p><strong>Affected:</strong> ChurchCRM CRM</p> <p>ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prior to rendering it within the browser&#39;s DOM. Although the application ultimately returns an HTTP 500 error due to the malformed API request caused by the payload, the browser&#39;s JavaScript engine parses and executes the injected &lt;script&gt; tags before the error response is returned — resulting in successful code execution regardless of the server-side error. This vulnerability is fixed in 7.1.0.</p> <p><strong>Affected:</strong> ChurchCRM CRM</p> <p>ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prior to rendering it within the browser&#39;s DOM. Although the application ultimately returns an HTTP 500 error due to the malformed API request caused by the payload, the browser&#39;s JavaScript engine parses and executes the injected &lt;script&gt; tags before the error response is returned — resulting in successful code execution regardless of the server-side error. This vulnerability is fixed in 7.1.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-39338