CVE-2026-39332

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:33+00:00| seen| Telegram/MwNatB1kDaoxbSrZihFWwC12FE1HreAtxbr2hmQcZTjcFY 2026-04-07 19:39:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwjrzupty23 2026-04-08 08:15:04+00:00| seen|...

CVE-2026-39323

creationtimestamp| type| source ---|---|--- 2026-04-07 19:35:16+00:00| seen| Telegram/yEepCm2Odjvpf0uI90hS1hr8dhkmidpoORZ8hNAmW5Xwfo 2026-04-07 19:44:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwk4carkf2q 2026-04-08 09:07:35+00:00| seen|...

CVE-2026-39326

creationtimestamp| type| source ---|---|--- 2026-04-07 19:32:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwjfl5pyy2z 2026-04-07 19:35:24+00:00| seen| Telegram/d9ntGhgAXUNib3HVhoGCh5gTeuhEkXLp8JxGb0TRA4y7Jks 2026-04-08 09:07:42+00:00| seen|...

CVE-2026-39344

creationtimestamp| type| source ---|---|--- 2026-04-07 19:28:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwj6moi4g27 2026-04-07 19:35:57+00:00| seen| Telegram/R04Jnimv0i8bRzdrQmyXdIyX4oD8CszgjzD3ZP34LCmicTY 2026-04-08 07:21:40+00:00| seen|...

CVE-2026-39328

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, an...

CVE-2026-39328 ChurchCRM has Stored XSS in Social Profile Fields

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, an...

CVE-2026-39328 ChurchCRM has Stored XSS in Social Profile Fields

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, an...

CVE-2026-39328 ChurchCRM has Stored XSS in Social Profile Fields

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, an...

CVE-2026-39328

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, an...

CVE-2026-39328

ChurchCRM before 7.1.0 has a stored XSS in the person profile editing feature. Non-admin users with EditSelf can inject JavaScript into Facebook, LinkedIn, and X profile fields; due to a 50-character limit, payloads span all three fields and chain onfocus handlers to execute when a profile is vie...

CVE-2026-5731

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM 2026-04-08 12:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6aeqsg2z 2026-04-09 00:01:20+00:00| seen|...

CVE-2026-35554

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM 2026-04-16 11:30:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjmco46nbc2h...

CVE-2026-5732

creationtimestamp| type| source ---|---|--- 2026-04-07 17:28:27+00:00| seen| Telegram/JtakylbYKAfJvCRBIgmgtreOTLAC-UR5YdC-v7gW7NnsM 2026-04-08 12:10:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6aeqsg2z 2026-04-09 00:01:18+00:00| seen|...

CVE-2026-35576

ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting XSS vulnerability exists in ChurchCRM within the Person Property Management subsystem. This issue persists in versions patched for CVE-2023-38766 and allows an authenticated user to inject arbitrar...

CVE-2026-34989

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0, the application fails to properly sanitize user-controlled input when users update their profile name e.g., full name / username. An...

CVE-2026-3902

creationtimestamp| type| source ---|---|--- 2026-04-07 16:06:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miw5w2nhm324 2026-04-07 19:33:24+00:00| seen| Telegram/UR5TCX5vufcj9skQtsOGmPNpHO32u3eWlC-vhPXaaDs7Lc...

CVE-2026-35534 ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use of sanitizeText as an output sanitizer for HTML attribute context. The function only strips HTML tags, it does not escape quote character...

CVE-2026-35534 ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use of sanitizeText as an output sanitizer for HTML attribute context. The function only strips HTML tags, it does not escape quote character...

EUVD-2026-19718

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use of sanitizeText as an output sanitizer for HTML attribute context. The function only strips HTML tags, it does not escape quote character...

CVE-2026-39865

creationtimestamp| type| source ---|---|--- 2026-04-07 15:38:21+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-qj83-cq47-w5f8 2026-04-08 18:06:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyv426cdt2g...