Lucene search

MitreCVELIST:CVE-2020-28849

HistoryAug 11, 2023 - 12:00 a.m.

CVE-2020-28849

2023-08-1100:00:00

mitre

www.cve.org

churchcrm

xss

add new deposit

view all deposit

remote attackers

arbitrary code

sensitive information

crafted payload

5.6 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.2%

JSON

Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module.

References

github.com/ChurchCRM/CRM/issues/5477