CVE-2026-35574

Περιγραφή

ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM-s Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users- browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.