CVE-2026-39335

MediumCVSS 6.1/10Last modified Oct 26, 2026

Description

ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused. This vulnerability is fixed in 7.1.1.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
ChurchCRMCRM< 7.1.1

References

Timeline

Published
Apr 7, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-393366.1ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Directory Reports formCVE-2026-3933710.0ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChuCVE-2026-393386.1ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the seaCVE-2026-393399.1ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API midCVE-2026-39346.5Insufficient policy enforcement in ChromeDriver in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass same origin poliCVE-2026-393408.1ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in PropertyTypeEditor.php, part oCVE-2026-393418.1ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL injection due to an imCVE-2026-393428.8ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnCVE-2026-393437.2ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, wCVE-2026-393448.1ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the lCVE-2026-393454.9OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source fails to restrict email templateCVE-2026-393465.4OrangeHRM is a comprehensive human resource management (HRM) system. From 5.0 to 5.8, OrangeHRM Open Source allowed authenticated users to b
CVE-2026-39335: Medium severity, CVSS 6.1 | Vulnix