CVE-2024-36647 Vulnerability Details

Record summary

CVE-2024-36647 has a selected CVSS score of 5.4 (medium).

Description

A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationPoC

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 13, 2024 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
churchcrm Browse churchcrm / churchcrm Default status: unknown	CVE List	5.8.0	affected

References

github.com

https://github.com/ChurchCRM/CRM/issues/7029

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2024-36647