ChurchCRM

Records127All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical25CVSS 9.0–10.0

CVSS high62CVSS 7.0–8.9

Exploited now

ChurchCRM records in CISA KEV

No ChurchCRM vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Churchcrm 110 records HIGH

Records

127 records

TI-2026-30599 CVE-2026-42288

ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD

HIGH 82

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00715 Published 2026-05-12 Fixed in 7.3.2 CWE-94

TI-2026-28325 CVE-2026-39337

ChurchCRM Affected by Unauthenticated RCE in Install Wizard

HIGH 82

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00727 Published 2026-04-07 Fixed in 7.1.0 CWE-94

TI-2025-38761 CVE-2025-62521

ChurchCRM has unauthenticated RCE in its Install Wizard

HIGH 82

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.04507 Published 2025-12-17 Fixed in 5.21.0 CWE-94

TI-2024-35802 CVE-2024-53438 · GHSA-gr5x-8j97-qq23

EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection.

HIGH 82

EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00547 Published 2024-11-22 No fix listed CWE-89

TI-2024-16997 CVE-2024-25894 · GHSA-j38w-4mxv-xjj3

ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter.

HIGH 82

ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00654 Published 2024-02-21 No fix listed CWE-89

TI-2025-41969 CVE-2025-68400

ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

HIGH 81

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00384 Published 2025-12-17 Fixed in 6.5.3 CWE-89

TI-2025-00963 CVE-2025-1135 · GHSA-264g-h4m4-r2w6

SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php

HIGH 81

A vulnerability exists in ChurchCRM 5.13.0.

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.00759 Published 2025-02-19 No fix listed CWE-89

TI-2025-00962 CVE-2025-1134 · GHSA-gw2v-7p5h-4fwr

SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php

HIGH 81

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functi…

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.00759 Published 2025-02-19 No fix listed CWE-89

TI-2025-00961 CVE-2025-1133 · GHSA-6ghc-h6hx-hq7x

SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php

HIGH 81

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees functionality.

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.00631 Published 2025-02-19 No fix listed CWE-89

TI-2025-00960 CVE-2025-1132 · GHSA-32xx-6c3g-hvfm

SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.php

HIGH 81

A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter.

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.0058 Published 2025-02-19 No fix listed CWE-89

TI-2026-28327 CVE-2026-39339

ChurchCRM has an API Authentication Bypass

HIGH 80

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01351 Published 2026-04-07 Fixed in 7.1.0 CWE-284

TI-2024-16996 CVE-2024-25893 · GHSA-g4fx-wxmx-fjq5

ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via…

HIGH 80

ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00366 Published 2024-02-21 No fix listed CWE-89

TI-2026-32459 CVE-2026-44547

ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

HIGH 76

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00264 Published 2026-05-12 Fixed in 7.3.1 CWE-287

TI-2026-28330 CVE-2026-39342

ChurchCRM has a SQL injection searchwhat parameter via QueryView.php

HIGH 76

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00321 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2025-41701 CVE-2025-68112

ChurchCRM has SQL injection in EditEventAttendees.php

HIGH 76

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00426 Published 2025-12-17 Fixed in 6.5.3 CWE-89

TI-2025-41699 CVE-2025-68110

ChurchCRM discloses database information on error message

HIGH 76

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00422 Published 2025-12-17 Fixed in 6.5.3 CWE-200

TI-2025-41851 CVE-2025-68275

ChurchCRM vulnerable to Stored XSS - Group name > Person Listing

HIGH 75

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.2 Network High privileges User interaction EPSS 0.00207 Published 2025-12-17 Fixed in 6.5.3 CWE-79

TI-2025-41503 CVE-2025-67876

ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking

HIGH 75

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.3 Network Low privileges User interaction EPSS 0.00197 Published 2025-12-17 No fix listed CWE-79

TI-2025-40834 CVE-2025-66397

ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control

HIGH 75

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00295 Published 2025-12-17 Fixed in 6.5.3 CWE-284

TI-2025-00865 CVE-2025-1023 · GHSA-4h72-f3hc-p28v

SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php

HIGH 75

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality.

CVSS 4.0CRITICAL 9.3 Network High privileges No interaction EPSS 0.02455 Published 2025-02-18 No fix listed CWE-89

TI-2026-42021 CVE-2026-58409

ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00569 Published 2026-07-13 Fixed in 7.4.0 CWE-434

TI-2026-29318 CVE-2026-40582

ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00502 Published 2026-04-17 Fixed in 7.2.0 CWE-288

TI-2026-29235 CVE-2026-40484

ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00867 Published 2026-04-17 Fixed in 7.2.0 CWE-269

TI-2026-28316 CVE-2026-39328

ChurchCRM has Stored XSS in Social Profile Fields

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00207 Published 2026-04-07 Fixed in 7.1.0 CWE-79

TI-2026-27677 CVE-2026-35573

ChurchCRM has a Path traversal leads to RCE

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00795 Published 2026-04-07 Fixed in 6.5.3 CWE-22

Open these records in search →