CVE Watch24 jul 2026

CVE-2026-39390

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support

CVSS

5.5

Medio

EPSS

0.2%

p14

KEV

—

Exploit Today

0-100

Publicado: 8 abr 2026 · Última mod.: 24 jul 2026 · CWE-79

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-07-292026-08-26

Descripción técnica

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc="..."> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability is fixed in 0.31.4.0.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-782827.1 ALT

4.4%

——1Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.2d CVE-2026-782647.1 ALT

4.1%

——1Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.2d CVE-2026-782637.1 ALT

4.1%

——1Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.2d CVE-2026-325567.1 ALT

4.1%

——1Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.2d CVE-2026-715036.1 MED

11.2%

——3Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.3d CVE-2026-308648.9 ALT

9.7%

——3Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.3d