Vulnerabilities

TI-2026-28804 CVE-2026-39941

ChurchCRM has an XSS vulnerability

MEDIUM 57

ChurchCRM is an open-source church management system.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00274 Published 2026-04-09 Fixed in 7.1.0 CWE-79

TI-2026-28325 CVE-2026-39337

ChurchCRM Affected by Unauthenticated RCE in Install Wizard

HIGH 82

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00727 Published 2026-04-07 Fixed in 7.1.0 CWE-94

TI-2026-28308 CVE-2026-39319

ChurchCRM has a Second Order SQLI via FundRaiserEditor.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00248 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28332 CVE-2026-39344

Reflected XSS the login page through the 'username' parameter

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.00244 Published 2026-04-07 Fixed in 7.1.0 CWE-79

TI-2026-28331 CVE-2026-39343

ChurchCRM has a SQL Injection in Event Type Editor (Admin)

HIGH 67

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00259 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28330 CVE-2026-39342

ChurchCRM has a SQL injection searchwhat parameter via QueryView.php

HIGH 76

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00321 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28329 CVE-2026-39341

SQL injection in ChurchCRM.0

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00285 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28328 CVE-2026-39340

ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0023 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28327 CVE-2026-39339

ChurchCRM has an API Authentication Bypass

HIGH 80

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01351 Published 2026-04-07 Fixed in 7.1.0 CWE-284

TI-2026-28326 CVE-2026-39338

ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00228 Published 2026-04-07 Fixed in 7.1.0 CWE-1004

TI-2026-28324 CVE-2026-39336

ChurchCRM has Stored XSS from unescaped config values in HTML attributes

MEDIUM 62

ChurchCRM is an open-source church management system.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00215 Published 2026-04-07 Fixed in 7.1.0 CWE-79

TI-2026-28322 CVE-2026-39334

ChurchCRM has a Blind SQL injection in SettingsIndividual.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00262 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28321 CVE-2026-39333

ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php

LOW 39

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00219 Published 2026-04-07 Fixed in 7.1.0 CWE-79

TI-2026-28320 CVE-2026-39332

ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00207 Published 2026-04-07 Fixed in 7.1.0 CWE-79

TI-2026-28319 CVE-2026-39331

ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families

HIGH 68

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00218 Published 2026-04-07 Fixed in 7.1.0 CWE-639

TI-2026-28318 CVE-2026-39330

ChurchCRM has a Blind SQL injection in PropertyAssign.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00248 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28317 CVE-2026-39329

ChurchCRM has a Blind SQL injection in EventNames.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00248 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28316 CVE-2026-39328

ChurchCRM has Stored XSS in Social Profile Fields

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00207 Published 2026-04-07 Fixed in 7.1.0 CWE-79

TI-2026-28315 CVE-2026-39327

ChurchCRM has a SQL injection in MemberRoleChange.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00248 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28314 CVE-2026-39326

ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00248 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28313 CVE-2026-39325

ChurchCRM has a Blind SQL injection in SettingsUser.php

HIGH 67

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00259 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28307 CVE-2026-39318

ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00346 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28323 CVE-2026-39335

ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls

MEDIUM 62

ChurchCRM is an open-source church management system.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00262 Published 2026-04-07 Fixed in 7.1.1 CWE-79

TI-2026-27680 CVE-2026-35576

ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00265 Published 2026-04-07 Fixed in 7.0.0 CWE-79

TI-2026-27679 CVE-2026-35575

ChurchCRM has Stored XSS in Group Name

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00252 Published 2026-04-07 Fixed in 6.5.3 CWE-1004

Vulnerabilities

Filters