EUVD-2026-80938
GHSA-83j3-x93q-5c35
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv submitter (PR:L) and a victim must view the record (UI:R); stored XSS executes in a different security context (S:C) allowing limited session/data read and DOM tampering (C:L/I:L), no availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of the file src/main/resources/public/js/customerServe/customer.serve.js of the component Save Endpoint. This manipulation of the argument customerName causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stored cross-site scripting in ChangeWeDer CRM allows an authenticated low-privilege user to plant JavaScript in the customerName argument submitted through the customer record Save Endpoint (src/main/resources/public/js/customerServe/customer.serve.js), which then executes in the browser of a CRM operator who later opens the same customer record. The project follows a rolling-release model, so no affected or fixed version numbers are published, and the maintainers were notified through an upstream GitHub issue but have not responded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privilege account on the ChangeWeDer CRM (PR:L) with the ability to submit/save a customer record through the Save Endpoint, and it requires a second user (e.g., a CRM operator) to subsequently view the record so the injected customerName payload renders in their browser (UI:P - passive victim interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but low-to-moderate severity finding, not a top priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis and no fixed version is published: the project was informed through https://github.com/ChangeWeDer/crm/issues/4 and has not responded, so remediation must currently be compensating. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The package manager in Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to execute arbitrary ASP c
The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data. Rated medium severity (CVSS 6.1), this vulner
Pre-authentication remote code execution in ChurchCRM before 7.3.2 allows unauthenticated attackers to inject and execut
Authentication bypass in ChurchCRM 7.2.0 through 7.2.2 re-exposes a previously patched flaw (CVE-2026-4058) because the
SQL injection in Chanjet CRM 1.0 allows remote unauthenticated attackers to manipulate the gblOrgID parameter of /tools/
SQL injection in Chanjet CRM's jxf_dump_table.php endpoint allows remote unauthenticated attackers to manipulate the gbl
Remote code execution in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to upload malicious files
Remote code execution in ChurchCRM before 7.4.0 lets an authenticated administrator run arbitrary PHP on the server by i
Sitecore CRM 8.1 Rev 151207 allows remote authenticated administrators to read arbitrary files via an absolute path trav
ChurchCRM church management system versions before 7.1.0 allow authenticated users with EditSelf permission to exfiltrat
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with ManageGroups role to execute arbitrar
SQL injection in ChurchCRM 7.0.5 /SettingsIndividual.php endpoint allows authenticated low-privilege users to extract, m
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today