CVE-2020-28849: Churchcrm

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module.

Affected products

• Churchcrm Churchcrm: up to and including 4.2.1

Published 2023-08-11. Last modified 2026-06-17.