A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Churchcrm
  • Churchcrm

Configuration 1 [-]

cpe:2.3:a:churchcrm:churchcrm:5.5.0:*:*:*:*:*:*:*

No data.

References
Link Providers
https://github.com/ChurchCRM/CRM/issues/6851 cve-icon cve-icon
History

Sat, 12 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00068}

 epss

{'score': 0.00093}

Fri, 11 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00052}

 epss

{'score': 0.00068}

Fri, 28 Mar 2025 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 12 Feb 2025 01:30:00 +0000

Type Values Removed Values Added
First Time appeared Churchcrm
Churchcrm churchcrm
Weaknesses CWE-79
CPEs cpe:2.3:a:churchcrm:churchcrm:5.5.0:*:*:*:*:*:*:*
Vendors & Products Churchcrm
Churchcrm churchcrm
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-03-28T16:57:46.934Z

Reserved: 2024-02-12T00:00:00.000Z

Link: CVE-2024-25898

cve-icon Vulnrichment

Updated: 2024-08-01T23:52:06.175Z

cve-icon NVD

Status : Modified

Published: 2024-02-21T18:15:51.820

Modified: 2025-03-28T17:15:26.860

Link: CVE-2024-25898

cve-icon Redhat

No data.