Beschreibung
ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM-s Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users- browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.
CVSS 7.3EPSS 0.308%Risiko 0.75
Quelle öffnen- Veröffentlicht
- 2026-04-07 17:16:32
- Betroffene Versionen
- <6.5.3
- Typ
- Installed app
- Vektor
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N