CVE-2024-25898

A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php.
References
Link Resource
https://github.com/ChurchCRM/CRM/issues/6851 Exploit Issue Tracking
https://github.com/ChurchCRM/CRM/issues/6851 Exploit Issue Tracking
Configurations

Configuration 1 (hide)

cpe:2.3:a:churchcrm:churchcrm:5.5.0:*:*:*:*:*:*:*

History

12 Feb 2025, 01:12

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 6.1
CWE CWE-79
References () https://github.com/ChurchCRM/CRM/issues/6851 - () https://github.com/ChurchCRM/CRM/issues/6851 - Exploit, Issue Tracking
First Time Churchcrm churchcrm
Churchcrm
CPE cpe:2.3:a:churchcrm:churchcrm:5.5.0:*:*:*:*:*:*:*

21 Nov 2024, 09:01

Type Values Removed Values Added
References () https://github.com/ChurchCRM/CRM/issues/6851 - () https://github.com/ChurchCRM/CRM/issues/6851 -

22 Feb 2024, 19:07

Type Values Removed Values Added
Summary
  • (es) Se encontró una vulnerabilidad XSS en la funcionalidad ChurchCRM v.5.5.0, edite su evento, donde se puede insertar código JS o HTML malicioso en el campo Event Sermon en EventEditor.php.

21 Feb 2024, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-02-21 18:15

Updated : 2025-03-28 17:15


NVD link : CVE-2024-25898

Mitre link : CVE-2024-25898

CVE.ORG link : CVE-2024-25898


JSON object : View

Products Affected

churchcrm

  • churchcrm
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')