PT-2026-30961 · Churchcrm · Churchcrm

Hackinkraken · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39338

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.1.0

Description ChurchCRM, an open-source church management system, has a Blind Reflected Cross-Site Scripting issue in the search parameter of the dashboard. The application does not properly sanitize or encode user input before rendering it in the browser's Document Object Model (DOM). Even though the application returns an HTTP 500 error because of the malformed API request caused by the payload, the browser's JavaScript engine parses and executes the injected

Recommendations Update to version 7.1.0 or later.

Fix

XSS

Weakness Enumeration

CWE-1004

CWE-79

Related Identifiers

CVE-2026-39338

Affected Products

Churchcrm

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39338 · Security Note
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3ghg-qfqw-rcqf · Note
• https://twitter.com/CVEnew/status/2041603176994947466 · Twitter Post