PT-2026-20912 · Churchcrm · Churchcrm

Shingleskat · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2026-26059

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.8.2

Description ChurchCRM is an open-source church management system. An authenticated user with permission to edit groups could store a JavaScript payload that would execute when the group was viewed in the Group View. The Group View is the affected component. Version 6.8.2 resolves this issue.

Recommendations Update to version 6.8.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-26059

GHSA-3WP4-VPR7-47Q6

Produtos afetados

Churchcrm

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26059.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3wp4-vpr7-47q6 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2025809101268320383 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-26059 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26059 · Aviso do Fabricante