CVE-2023-26843

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php...

PT-2023-20819 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.3 Description: A stored Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. This enables attackers to execute malicious scripts on the victim's browser,...

CVE-2023-26843

CVE-2023-26843 affects ChurchCRM 4.5.3. A stored XSS flaw allows remote attackers to inject arbitrary scripts via NoteEditor.php. Exploitation could enable scripted actions in users’ browsers and potentially data theft or session manipulation as described by the connected nuclei entry. Mitigation...

CVE-2023-26843

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php...