CVE-2025-1024highCWE-287

CVE-2025-1024: falha de alta gravidade em ChurchCRM

Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter

Publicada em

Seguir esta CVE+ Monitorar ChurchCRM

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.4epss 0.3%
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XSS) in the EditEventAttendees.php page. This requires Administration privileges and affects the EID parameter. The flaw allows an attacker to steal session cookies, perform actions on behalf of an authenticated user, and gain unauthorized access to the application.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:L/VA:H/SC:H/SI:L/SA:H/AU:Y/R:U/V:C/RE:L/U:Amber
Produtos afetados
ChurchCRM · ChurchCRM
CVEs relacionadas — ChurchCRM

No mesmo produto, das mais perigosas para as menos.

CVE-2025-1023CRITICALSQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.phpEPSS 2.5%CVE-2025-1135CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpEPSS 0.8%CVE-2025-1134CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpEPSS 0.8%CVE-2025-1133CRITICALSQL Injection in ChurchCRM EID Parameter via EditEventAttendees.phpEPSS 0.6%CVE-2025-1132CRITICALSQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.phpEPSS 0.6%CVE-2025-0981HIGHSession Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldEPSS 0.2%