A vulnerability marked as problematic has been reported in ci4-cms-erp ci4ms 0.28.5.0/0.31.0.0/0.31.2.0. This impacts the function
UserController::ajax_blackList_post. The manipulation of the argument note leads to cross site scripting.
This vulnerability is referenced as CVE-2026-39391. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
