Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module.
References
| Link | Resource |
|---|---|
| https://github.com/ChurchCRM/CRM/issues/5477 | Exploit Issue Tracking |
| https://github.com/ChurchCRM/CRM/issues/5477 | Exploit Issue Tracking |
Configurations
History
21 Nov 2024, 05:23
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/ChurchCRM/CRM/issues/5477 - Exploit, Issue Tracking |
17 Aug 2023, 01:55
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-79 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
| CPE | cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* | |
| First Time |
Churchcrm churchcrm
Churchcrm |
|
| References | (MISC) https://github.com/ChurchCRM/CRM/issues/5477 - Exploit, Issue Tracking |
11 Aug 2023, 15:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-11 14:15
Updated : 2024-11-21 05:23
NVD link : CVE-2020-28849
Mitre link : CVE-2020-28849
CVE.ORG link : CVE-2020-28849
JSON object : View
Products Affected
churchcrm
- churchcrm
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')