CVE-2022-36137

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location...

4.8 Medium

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.54%Down 0.3 points since Nov 29, 2022

What each source reports

NVD Score used 4.8

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

Record: CVE-2022-36137
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List 4.8

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

Record: CVE-2022-36137
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-38858 4.8

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

Record: EUVD-2022-38858
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cxvx-jrq9-m836 4.8

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location...

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

Record: GHSA-cxvx-jrq9-m836
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 4.8

ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.

Record: CVE-2022-36137
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

churchcrm

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-36137 is a medium vulnerability (CVSS 4.8) in Churchcrm, published November 29, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. No source names a fixed version.

Attack profile

How easy it is to exploit

What an attacker can affect

Exploit likelihood

What each source reports

Affected products

History

In short

References