PT-2026-5408 · Churchcrm · Churchcrm

Sonntb21Dcat164 · Published 2026-01-30 · Updated 2026-02-17 · CVE-2026-24855

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.7.2

Description ChurchCRM, an open-source church management system, contains a Stored Cross-Site Scripting (XSS) issue in the Create Events feature within the Church Calendar. A user with limited privileges can inject malicious code into the Description field. This code is then saved to the database and executed when other users, including administrators, view the event. This can lead to account compromise.

Recommendations Update to ChurchCRM version 6.7.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-24855

GHSA-49QP-CFQX-C767

Affected Products

Churchcrm

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24855.json · Exploit
• https://github.com/ChurchCRM/CRM/commit/0cd0d211459b8c19509d36b3c1dfcd7f8c10d914 · Patch
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-49qp-cfqx-c767 · Vendor Advisory
• https://github.com/ChurchCRM/CRM/commit/ec4b16e9a3ca09c8a01a712bcb90579c42f2ba28 · Patch
• https://osv.dev/vulnerability/CVE-2026-24855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24855 · Security Note
• https://t.me/CVEtracker/43289 · Telegram Post
• https://twitter.com/CVEnew/status/2017264937656258707 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2017283034496614616 · Twitter Post
• https://t.me/cveNotify/152171 · Telegram Post