CVE-2023-38766

MediumCVSS 5.4

Published: 08/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.63%

45th percentile - higher than 45% of all known CVEs

Summary

The Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.

Risk Assessment

An attacker could exploit this vulnerability to gain control over the application, potentially leading to user data theft or other malicious activities.

Recommendation

It is recommended to upgrade to the latest version of ChurchCRM to mitigate this vulnerability and implement additional protections against XSS attacks.

Original NVD description (English source)

Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.