Lucene search
China National Vulnerability DatabaseCNVD-2023-64495HistoryMay 19, 2023 - 12:00 a.m.
ChurchCRM Cross-Site Scripting Vulnerability (CNVD-2023-64495)
2023-05-1900:00:00
China National Vulnerability Database
www.cnvd.org.cn
6
churchcrm
open source
crm system
churches
version 4.5.4
cross-site scripting
vulnerability
filtering
escaping
user-supplied data
attacker
execute
arbitrary
web script
html
injected payload
0.001 Low
EPSS
Percentile
25.8%
ChurchCRM is an open source CRM system for churches. A cross-site scripting vulnerability exists in ChurchCRM v4.5.4. The vulnerability stems from the application’s lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a crafted payload.
| CPE | Name | Operator | Version |
|---|---|---|---|
| churchcrm churchcrm v | eq | 4.5.4 |
Related
cve
cve
CVE-2023-31699
2023-05-17 13:15:09
osv
osv
CVE-2023-31699
2023-05-17 13:15:09
prion
prion
Cross site scripting
2023-05-17 13:15:00
packetstorm
packetstorm
ChurchCRM 4.5.4 Cross Site Scripting
2023-05-19 00:00:00
nvd
nvd
CVE-2023-31699
2023-05-17 13:15:09
cvelist
cvelist
CVE-2023-31699
2023-05-17 00:00:00
zdt
zdt
ChurchCRM 4.5.4 Cross Site Scripting Vulnerability
2023-05-19 00:00:00
exploitdb
exploitdb
ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
2023-05-23 00:00:00