CVE-2023-27059 Cross-site scripting in n/a

What is CVE-2023-27059?

CVE-2023-27059 is a high-severity cross-site scripting vulnerability in Churchcrm Churchcrm, published on 16 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field.

Weakness: CWE-79

Which versions are affected by CVE-2023-27059?

It affects 1 product.

Products include Churchcrm Churchcrm.

How do I fix CVE-2023-27059?

No fix has been published for CVE-2023-27059 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-27059 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27059 exists.

Other vulnerabilities in Churchcrm Churchcrm

• CVE-2026-39337 ChurchCRM Affected by Unauthenticated RCE in Install Wizard Critical 10.0
• CVE-2025-62521 ChurchCRM has unauthenticated RCE in its Install Wizard Critical 10.0
• CVE-2025-68110 ChurchCRM discloses database information on error message Critical 10.0
• CVE-2024-53438 SQL injection in n/a Critical 9.8
• CVE-2024-25894 SQL injection in n/a Critical 9.8

All Churchcrm Churchcrm vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8v3x-hqhc-3hqw.