PT-2026-5408 · Churchcrm · Churchcrm

Sonntb21Dcat164 · Publicado 2026-01-30 · Atualizado 2026-02-17 · CVE-2026-24855

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.7.2

Description ChurchCRM, an open-source church management system, contains a Stored Cross-Site Scripting (XSS) issue in the Create Events feature within the Church Calendar. A user with limited privileges can inject malicious code into the Description field. This code is then saved to the database and executed when other users, including administrators, view the event. This can lead to account compromise.

Recommendations Update to ChurchCRM version 6.7.2 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-24855

GHSA-49QP-CFQX-C767

Produtos afetados

Churchcrm

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24855.json · Exploit
• https://github.com/ChurchCRM/CRM/commit/0cd0d211459b8c19509d36b3c1dfcd7f8c10d914 · Correção
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-49qp-cfqx-c767 · Aviso do Fabricante
• https://github.com/ChurchCRM/CRM/commit/ec4b16e9a3ca09c8a01a712bcb90579c42f2ba28 · Correção
• https://t.me/CVEtracker/43289 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2017264937656258707 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2017283034496614616 · Publicação no Twitter
• https://t.me/cveNotify/152171 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2026-24855 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-24855 · Nota de Segurança