CVE-2026-32880 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payloa…
Medium CVSS: 6.4

CVE-2026-32880

ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payload that can execute when any admin views the system settings. The JSON input is left unescaped/unsanitized in SystemSettings.php, leading to XSS. This issue has been fixed in version 7.0.2.
Vendor
Churchcrm
Product
Churchcrm
CWE
CWE-79
Yayın Tarihi
2026-03-20 02:16:36
Güncelleme
2026-03-23 15:29:56
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-79 Churchcrm MEDIUM Churchcrm 2026

Referanslar

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7gq6-xmpx-qc7c https://github.com/ChurchCRM/CRM/security/advisories/GHSA-7gq6-xmpx-qc7c