A reflected cross‑site scripting vulnerability exists on the login page of ChurchCRM versions prior to 7.1.0. The username query string is rendered directly into the input field without sanitization, allowing an attacker to inject JavaScript that will execute in the victim’s browser when the crafted URL is visited. The script can steal session cookies or redirect the user, compromising user session confidentiality and availability.

The flaw affects the open‑source ChurchCRM management system, specifically its login page component. All installations running a version before 7.1.0 are vulnerable. The product is commonly used by churches for member management.

The high CVSS score of 8.1 reflects the severity of this client‑side vulnerability. While the probability assessment shows a low likelihood of exploitation at present, the attack is straightforward and requires no authentication; any user who opens the malicious link could be affected. The vulnerability is not listed in the known exploits catalog yet, but its impact and accessibility warrant timely remediation.