EUVD-2026-22011Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For this write-up the DonatedItemEditor.php will be used as an example, however wherever all instances of 'linkBack' should be assessed. This vulnerability is fixed in 7.0.0.
AnalysisAI
Open redirect vulnerability in ChurchCRM prior to 7.0.0 allows authenticated users to be redirected to arbitrary URLs via malicious 'linkBack' parameters across multiple application pages, including DonatedItemEditor.php. An attacker can craft a link embedding an attacker-controlled URL that executes when a victim clicks the 'Cancel' button, enabling phishing and credential harvesting attacks. EPSS scoring (0.04%, percentile 11%) indicates low real-world exploitation probability despite authenticated access requirement.
Technical ContextAI
ChurchCRM is a PHP-based open-source church management system (CPE: cpe:2.3:a:churchcrm:crm). The vulnerability stems from improper validation of the 'linkBack' parameter across multiple editor pages, a classic open redirect scenario classified as CWE-601 (URL Redirection to Untrusted Site). The application fails to restrict or validate the target URL before redirecting authenticated users, allowing an attacker to specify arbitrary external URLs. The vulnerability affects all instances of 'linkBack' usage, with DonatedItemEditor.php cited as a representative example. The attack leverages the application's redirect mechanism to bypass user trust signals (users see a legitimate ChurchCRM domain initially), making it effective for phishing attacks.
RemediationAI
Vendor-released patch: ChurchCRM 7.0.0 and later. Organizations should upgrade ChurchCRM immediately to version 7.0.0 or newer, which includes fixes for all instances of the 'linkBack' parameter vulnerability. Interim mitigation for users unable to upgrade immediately includes restricting email forwarding of internal ChurchCRM links to trusted domains only and implementing email filtering rules to flag external redirects. Detailed patch information and upgrade instructions are available in the GitHub security advisories at https://github.com/ChurchCRM/CRM/security/advisories/GHSA-5g52-rvjf-6wwf and https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v3hj-33xf-qx47.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Share
External POC / Exploit Code
Leaving vuln.today