CVE-2023-38761

MediumCVSS 6.1

Published: 08/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.67%

47th percentile - higher than 47% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.

Risk Assessment

An attacker can exploit this vulnerability to gain control over the system, potentially leading to data theft or other malicious actions.

Recommendation

It is recommended to update to the latest version of ChurchCRM and implement appropriate protections against XSS attacks.

Original NVD description (English source)

Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.