Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39941 ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in… https://www.cve.org/CVERecord?id=CVE-2026-39941
Post summary
The passage describes an XSS flaw in ChurchCRM versions older than 7.1.0 that can be triggered via the EName and EDesc fields, but provides no PoC, patch, or exploitation evidence.
CVE-2026-39941 Cross-Site Scripting Vulnerability in ChurchCRM Prior to Version 7.1.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-39941
Post summary
The entry references CVE‑2026‑39941 as an XSS issue in ChurchCRM pre‑7.1.0, but offers no additional technical depth, PoC, exploitation or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |