CVE-2026-39344

Reflected XSS the login page through the 'username' parameter

State: Published
Severity: 8.1 High
Published: Apr 7, 2026
Updated: Apr 8, 2026
Reserved: Apr 6, 2026

Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0.

Scores

CVSS	Score	Vector	Source
3.0	8.1 High	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
CRMChurchCRM	< 7.1.0Affected

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.