Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input (DateStart and DateEnd) into HTML input field attributes without proper output encoding for the HTML attribute context. An authenticated attacker can craft a malicious URL that executes arbitrary JavaScript when visited by another authenticated user. This constitutes a reflected XSS vulnerability. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39333 ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input (DateStart and DateEnd) into HTML in… https://www.cve.org/CVERecord?id=CVE-2026-39333
Post summary
The post announces CVE-2026-39333 as a reflected XSS in ChurchCRM’s FindFundRaiser.php, but provides no PoC, exploit code, or patch details.
[CVE-2026-39333: HIGH] Vulnerability in ChurchCRM (prior to 7.1.0) allows authenticated attackers to execute arbitrary JavaScript via crafted URLs. Update to version 7.1.0 for the fix. #CyberSecurity#cve,CVE-2026-39333,#cybersecurity https://cvefind.com/CVE-2026-39333
Post summary
The tweet notes a high‑severity flaw in ChurchCRM enabling authenticated JavaScript injection via crafted URLs and urges users to upgrade to version 7.1.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |