ChurchCRM 跨站脚本漏洞

ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 7.1.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based cross-site scripting in the profile editing function, which could lead to session hijacking...

PT-2026-30952

ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, an...

CVE-2026-35454

creationtimestamp| type| source ---|---|--- 2026-04-06 23:22:19+00:00| seen| Telegram/F-tbnQCu7KGoJ0u4OEM4TknejxA1jNnRqA-1uSHs9aPRtPw 2026-04-06 23:47:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miuh67v5b223...

CVE-2026-35442

creationtimestamp| type| source ---|---|--- 2026-04-06 22:46:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miudrphust2d 2026-04-06 23:22:09+00:00| seen| Telegram/m01DCzKFy5kAtT9sjIWhyEARPkz65AkyqWTYGgzfJ1E6g 2026-04-07 05:00:27+00:00| seen|...

CVE-2026-35398

creationtimestamp| type| source ---|---|--- 2026-04-06 22:32:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miucy4wlng2o...

CVE-2026-5709

creationtimestamp| type| source ---|---|--- 2026-04-06 22:21:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miucg2xmrl2o 2026-04-06 23:22:29+00:00| seen| Telegram/dGmhhMfdsalqLxLHWWo3a-Yu-qP75XdMdTLlCh9YxDeGRw 2026-04-10 21:37:07+00:00| seen|...

CVE-2026-22675

creationtimestamp| type| source ---|---|--- 2026-04-06 22:16:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miuc4p6oll2s...

CVE-2026-35408

creationtimestamp| type| source ---|---|--- 2026-04-06 22:03:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miubert3ch2d 2026-04-06 23:22:09+00:00| seen| Telegram/m01DCzKFy5kAtT9sjIWhyEARPkz65AkyqWTYGgzfJ1E6g 2026-04-07 01:52:42+00:00| seen|...

CVE-2026-5708

Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio RES prior to version 2026.03 could allow an authenticated remote user to escalate privileges, assume the virtual desktop host instance profile permissions, and interact with...

CVE-2026-35203

creationtimestamp| type| source ---|---|--- 2026-04-06 21:21:26+00:00| published-proof-of-concept| Telegram/xKxKUYX0BRejEqYlrURXsjCQY9BctYcoeewNmSMWqY7riM 2026-04-07 05:39:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miv2ujyo2u27...

CVE-2024-14032

creationtimestamp| type| source ---|---|--- 2026-04-06 18:52:21+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mitwpdda7s2z 2026-04-14 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mjgfmj3sxd2v...

CVE-2026-34989

creationtimestamp| type| source ---|---|--- 2026-04-06 18:35:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitvrkwida25 2026-04-06 19:28:45+00:00| published-proof-of-concept| Telegram/ECjdy8s76GZBalwnIB79ij56tbajMeprVumTyCn-zmzM...

CVE-2025-47400

creationtimestamp| type| source ---|---|--- 2026-04-06 17:31:48+00:00| seen| Telegram/RGEnmBafEPc7BPP7Kak77rIihdcDD1YNCnC4ac8698Y1cM 2026-04-09 07:00:18+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mj2acursls2r 2026-06-01 18:00:00+00:00| seen|...

CVE-2026-34986

creationtimestamp| type| source ---|---|--- 2026-04-06 17:21:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitrngvcy22w 2026-04-06 18:26:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mitvbdh6do2s 2026-04-06 19:28:45+00:00| published-proof-of-concept|...

CVE-2026-0740

creationtimestamp| type| source ---|---|--- 2026-04-06 17:19:46+00:00| seen| https://bsky.app/profile/wordfenceofficial.bsky.social/post/3mitrjp4tp22q 2026-04-07 05:17:09+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3miuzmkuxzz2r 2026-04-07 05:30:31+00:00| seen|...

CVE-2026-34989

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0, the application fails to properly sanitize user-controlled input when users update their profile name e.g., full name / username. An...

CVE-2026-21373

creationtimestamp| type| source ---|---|--- 2026-04-06 17:07:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitqu3wcgt2x 2026-04-06 17:32:14+00:00| seen| Telegram/nEWPFpjCLkD7NyFP9hUQCVBBOcgamDzuZpgMFfkUJdzCqg 2026-04-09 16:37:08+00:00| seen|...

CVE-2026-21372

creationtimestamp| type| source ---|---|--- 2026-04-06 17:07:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitqtv7vnq2h 2026-04-06 17:31:52+00:00| seen| Telegram/bFzdXG4EHDXBh96IdapV4pte0L7R5RfWgLMclfBuHu5yA-8 2026-04-09 03:00:14+00:00| seen|...

CVE-2026-5583

A security vulnerability has been detected in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /my-profile.php of the component Parameter Handler. The manipulation of the argument fullname leads to sql injection. It is possible to initiate the attack remotel...

CVE-2026-21367

creationtimestamp| type| source ---|---|--- 2026-04-06 17:00:31+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mitqh7hpx22x 2026-04-06 17:31:48+00:00| seen| Telegram/RGEnmBafEPc7BPP7Kak77rIihdcDD1YNCnC4ac8698Y1cM 2026-04-09 04:40:08+00:00| seen|...