CVE-2025-68401

CVE-2025-68401 affects ChurchCRM prior to version 6.0.0, where user-supplied HTML/JS is stored without sufficient sanitization/encoding. Stored XSS can occur when other users view the content, potentially enabling attacker-controlled JavaScript to access web-origin data and perform privileged act...