EUVD-2026-23621Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
6DescriptionGitHub Advisory
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers, which execute in the browser of any administrator who subsequently views that user's editor page, resulting in stored XSS. This issue has been fixed in version 7.2.0.
AnalysisAI
Stored cross-site scripting in ChurchCRM UserEditor.php prior to version 7.2.0 allows authenticated administrators to inject malicious HTML and JavaScript into username fields, which then executes in the browsers of other administrators viewing the user editor page. The vulnerability stems from failure to sanitize usernames before rendering them into HTML input value attributes, and exploitation requires administrator-level privileges combined with user interaction (another admin viewing the compromised user's editor). This is a low-CVSS but real privilege-escalation concern within multi-administrator deployments, particularly where administrators may have differing trust levels.
Technical ContextAI
ChurchCRM is a PHP-based open-source church management system. The vulnerability exists in the UserEditor.php component, which renders user profile data retrieved from a database (stored username) directly into an HTML input element's value attribute using string concatenation or echo without applying PHP's htmlspecialchars() function. This allows an attribute-breaking payload - such as ' onload='alert(1)' - to close the value attribute and inject event handler attributes. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting), specifically the stored/persistent variant, since the malicious username persists in the database and triggers on every view of that user's editor page by any administrator. The attacker's JavaScript runs in the security context of the victim administrator's browser session, potentially allowing theft of session tokens, CSRF attacks, modification of other user accounts, or further administrator compromise.
RemediationAI
Upgrade ChurchCRM to version 7.2.0 or later, which applies htmlspecialchars() to username fields before rendering them in HTML input value attributes. This is the primary and complete fix. For organizations unable to upgrade immediately, implement a temporary compensating control: restrict administrator account access to only the minimum number of trusted staff members, and audit the user database for suspicious usernames containing HTML special characters (quotes, angle brackets, semicolons) or JavaScript event handler keywords (onload, onerror, onclick, etc.) - any match indicates a potential stored XSS payload. However, this detective control does not prevent exploitation, only identifies it. Additionally, configure web application firewalls or reverse proxies (if present) to log and monitor access to UserEditor.php for suspicious query patterns, though this does not block the attack. The most practical near-term mitigation is to use your organization's change management process to prioritize upgrading to 7.2.0 within your next patch cycle. After upgrade, no additional configuration is required; the fix is automatic.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today