CVE-2026-58411

HighCVSS 7.0/10Last modified Oct 24, 2026

Description

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into JavaScript string contexts and HTML attribute contexts without proper sanitization or contextual output encoding. Affected endpoints observed during testing: /FamilyCustomFieldsEditor.php, /PaddleNumList.php and /admin/system/church-info. Potential consequences include session-token theft, account takeover, unauthorized actions on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing, and privilege escalation when administrators are targeted. This issue has been resolved in version 7.4.0.

Metrics

CVSS 4.0 7.0/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-584136.1Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes t CVE-2026-584145.5Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects fil CVE-2026-584155.3Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all plat CVE-2026-584167.1Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)CVE-2026-584177.5REST API exposes organization membership of private organizations to public CVE-2026-584186.5SSRF via HTTP Redirect in Repository Migration CVE-2026-584197.5Notification API leaks private issue metadata after access revocation CVE-2026-58427.3A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of CVE-2026-584204.4Local File Inclusion via file:// URI in Migration Restore CVE-2026-584217.5Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service CVE-2026-584229.8Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVE-2026-584237.7LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories