Cross site scripting

2023-04-2513:15:00

PRIOn knowledge base

www.prio-n.com

stored xss

churchcrm 4.5.3

injection

input fields

eventeditor.php

0.001 Low

EPSS

Percentile

41.4%

JSON

A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the “Title” Input Field in EventEditor.php.

CPENameOperatorVersion
churchcrmeq4.5.3

CPE	Name	Operator	Version
	churchcrm	eq	4.5.3

References

github.com/10splayaSec/CVE-Disclosures/tree/main/ChurchCRM/CVE-2023-25347

github.com/ChurchCRM/CRM

0.001 Low

EPSS

Percentile

41.4%

JSON

Related for PRION:CVE-2023-25347