Xcapri

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 7.1.0 Description ChurchCRM, an open-source church management system, has a Reflected Cross-Site Scripting (XSS) issue on the login page. This is due to insufficient sanitization or encoding of the `username` parameter received from the URL. The value of the `username` parameter is directly displayed in the login page input element without filtering, enabling attackers to inject malicious JavaScript scripts. Successful exploitation can lead to the execution of scripts on the client side, potentially compromising sensitive data like session cookies or redirecting users to a malicious login form. Recommendations Update to version 7.1.0 or later.

**Name of the Vulnerable Software and Affected Versions** Formie versions prior to 2.1.6 **Description** The issue allows users with access to a form's settings to include malicious Twig code into fields that support Twig, such as the Submission Title or the Success Message. This code will then be executed upon creating a submission or rendering the text. The severity is listed as low-medium due to requiring control panel access to edit a form's settings. **Recommendations** For versions prior to 2.1.6, update to at least version 2.1.6 to resolve the issue. As a temporary workaround, consider restricting access to form settings to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Pimcore Admin Classic Bundle versions prior to 1.2.1 **Description** The issue allows an attacker to see the path to the webroot/file, which can be used in conjunction with other vulnerabilities, such as SQL Injection using the `load file()` query, to view the page source. In the case of Pimcore, the `fopen()` function does not have an error handle when the file does not exist on the server, causing the server response to reveal the full path, for example, "fopen(/var/www/html/var/tmp/export-{unique id}.csv)". **Recommendations** For Pimcore Admin Classic Bundle versions prior to 1.2.1, upgrade to version 1.2.1 to resolve the issue. There are no known workarounds for this vulnerability.