| शीर्षक | ChurchCRM 5.15.0 Cross Site Scripting |
|---|
| विवरण | Vendor was contacted via GitHub advisory on March 12th but has not responded in any way.
The advisory reports a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM v5.16.0, specifically in the Group Editor. Authenticated users with permission to create groups can inject malicious JavaScript into the Group Name field. This payload is later executed when viewing pages like "View Active People", enabling potential attacks such as session hijacking or defacement. The issue stems from improper output encoding of user-supplied input. |
|---|
| स्रोत | ⚠️ https://everydaysparkling.com/p/b4afe675-b7fb-4cf8-be90-e443ffddc0b6/ |
|---|
| उपयोगकर्ता | Jelle Janssens (UID 81048) |
|---|
| सबमिशन | 10/04/2025 03:29 PM (1 वर्ष पहले) |
|---|
| संयम | 26/04/2025 08:45 AM (16 days later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 223276 [ChurchCRM 4.5.3 Edit Group क्रॉस साइट स्क्रिप्टिंग] |
|---|
| अंक | 0 |
|---|