CVE-2025-67875

CVE-2025-67875 affects ChurchCRM prior to version 6.5.3. An authenticated user with mid-level permissions (Edit Records; Manage Properties and Classifications) can combine an IDOR with Broken Access Control to inject a persistent stored XSS payload into an administrator’s profile. The XSS execute...

GHSA-859J-668V-MRR6 Products.CMFPlone XSS in profile home_page property

A member of the Plone site could set javascript in the homepage property of their profile, and have this executed when a visitor clicks the home page link on the author page...

PYSEC-2018-71

A member of the Plone 2.5-5.1rc1 site could set javascript in the homepage property of his profile, and have this executed when a visitor click the home page link on the author page...