CVE-2024-25898

Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.5.0

Description A XSS issue was found in the functionality to edit events, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php. This allows for the potential execution of malicious code.

Recommendations For ChurchCRM version 5.5.0, consider disabling the editing of events or restricting access to the EventEditor.php file until a patch is available. Avoid inserting untrusted input into the Event Sermon field to minimize the risk of exploitation.