CVE-2025-1024

CVE-2025-1024 is a Reflected Cross-Site Scripting (XSS) vulnerability found in ChurchCRM version 5.13.0, specifically on the EditEventAttendees.php page. This flaw allows an attacker with administrative privileges to inject and execute arbitrary JavaScript in a victim's browser by manipulating the EID parameter. The successful exploitation of this vulnerability could lead to session cookie theft, unauthorized actions performed on behalf of an authenticated user, and potential unauthorized access to the application. The vulnerability has a CVSS score of 4.8 (Medium), indicating a network-based attack with low attack complexity, requiring high privileges and user interaction. While the potential impact on confidentiality and integrity is low, the scope is changed. Currently, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.