CVE-2026-35534 ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use of sanitizeText as an output sanitizer for HTML attribute context. The function only strips HTML tags, it does not escape quote character...

EUVD-2026-19718

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use of sanitizeText as an output sanitizer for HTML attribute context. The function only strips HTML tags, it does not escape quote character...

CVE-2026-39865

creationtimestamp| type| source ---|---|--- 2026-04-07 15:38:21+00:00| published-proof-of-concept| https://github.com/axios/axios/security/advisories/GHSA-qj83-cq47-w5f8 2026-04-08 18:06:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miyv426cdt2g...

CVE-2026-4401

creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:05+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-4401 2026-04-08 00:08:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwytkwmbm2z 2026-04-20 15:37:06+00:00| seen|...

CVE-2026-2263

creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:04+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2263 2026-04-08 00:06:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwyqus2xm2o 2026-04-20 13:37:06+00:00| seen|...

CVE-2026-1342

creationtimestamp| type| source ---|---|--- 2026-04-07 15:16:03+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-1342 2026-04-08 00:21:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miwzlkgt2f2i 2026-04-08 01:15:45+00:00|...

CVE-2026-25344

creationtimestamp| type| source ---|---|--- 2026-04-07 12:30:15+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mivrsrts472c...

CVE-2026-3177

creationtimestamp| type| source ---|---|--- 2026-04-07 10:40:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mivlonqsni2s...

CVE-2026-32535

creationtimestamp| type| source ---|---|--- 2026-04-07 09:30:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mivhqwagpq2o...

CVE-2026-5465

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider Employe...

CVE-2026-5465 Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider Employe...

CVE-2026-5465 Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider Employe...

CVE-2026-5465

Summary (technical): The Amelia Booking for Appointments and Events Calendar WordPress plugin (versions ≤ 2.1.3) is affected by an Insecure Direct Object Reference (IDOR) in the UpdateProviderCommandHandler. The handler does not validate ownership when a Provider (Employee) user updates their pro...

CVE-2026-5465

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3. This is due to the UpdateProviderCommandHandler failing to validate changes to the externalId field when a Provider Employe...

CVE-2026-20431

creationtimestamp| type| source ---|---|--- 2026-04-07 06:10:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miv4lgjejr25 2026-04-08 01:50:50+00:00| seen| https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-mediatek-7 2026-06-01 18:00:00+00:00| seen|...

CVE-2026-20432

creationtimestamp| type| source ---|---|--- 2026-04-07 06:02:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miv44zzap62i 2026-04-07 14:52:48+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mivzrg66ve2j 2026-04-07 15:20:46+00:00| seen|...

CVE-2026-39324

creationtimestamp| type| source ---|---|--- 2026-04-07 03:00:08+00:00| published-proof-of-concept| Telegram/c-9nM9mslhGNLfW7QsPDgkIMfnwsyr-9epKeORTrIU88Ta0 2026-04-07 03:00:11+00:00| published-proof-of-concept| Telegram/HzOqBhluyLlt9yC4XLrvomtg4oZEtrGKU8ieYWYpvETezc 2026-04-07 19:35:16+00:00| see...

CVE-2026-5690

creationtimestamp| type| source ---|---|--- 2026-04-07 01:16:43+00:00| published-proof-of-concept| Telegram/NRb0QMHrG2YdeQFhFIBC199wVAoJ1DSSMrQ5jp3E6gcHNig 2026-04-07 02:21:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miups2vcoa2q...

ChurchCRM 跨站脚本漏洞

ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.1.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based cross-site scripting in the profile editing function, which could lead to session hijacking...

PT-2026-30952

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, an...