CVE-2022-36136 - ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment

MEDIUM

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment

Published Nov 29, 2022

4.8

MEDIUM

CVSS 3.1

EPSS 0.53%

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://github.com/ChurchCRM/CRM/releases/tag/4.4.5		Release NotesThird Party Advisory
https://grimthereaperteam.medium.com/churchcrm-version-4-4-5-stored-xss-vulnerability-at-deposit-commend-839d2c587d6e		ExploitThird Party Advisory

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Nov 29, 2022

Updated Apr 25, 2025

Reserved Jul 18, 2022

Updated Apr 25, 2025

Status Modified

Modified Jun 17, 2026

Severity n/a

Public date n/a