PT-2026-30920 · Churchcrm · Churchcrm

Uartu0 · CVE-2026-35574 · Published 2026-04-07 · Updated 2026-04-07

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3

Description ChurchCRM, an open-source church management system, contains a stored Cross-Site Scripting (XSS) flaw in the Note Editor. Authenticated users with note-adding permissions can execute arbitrary JavaScript code in the context of other users’ browsers, including administrators. This could lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data.

Recommendations Update to version 6.5.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35574

GHSA-CX82-8XRH-7F5C

Affected Products

Churchcrm

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35574.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-cx82-8xrh-7f5c · Exploit
• https://osv.dev/vulnerability/CVE-2026-35574 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35574 · Security Note
• https://twitter.com/CVEnew/status/2041569964235370801 · Twitter Post