Vulnerabilities

TI-2026-42023 CVE-2026-58411

ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

MEDIUM 64

ChurchCRM is an open-source church management system.

CVSS 4.0HIGH 7.0 Network No auth User interaction EPSS 0.00432 Published 2026-07-13 Fixed in 7.4.0 CWE-79

TI-2026-42022 CVE-2026-58410

ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records

MEDIUM 64

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00212 Published 2026-07-13 Fixed in 7.4.0 CWE-639

TI-2026-42021 CVE-2026-58409

ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00569 Published 2026-07-13 Fixed in 7.4.0 CWE-434

TI-2026-42020 CVE-2026-58408

ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII

LOW 29

ChurchCRM is an open-source church management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00361 Published 2026-07-13 Fixed in 7.4.0 CWE-862

TI-2026-32460 CVE-2026-44548

ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)

HIGH 68

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00138 Published 2026-05-12 Fixed in 7.3.2 CWE-352

TI-2026-32459 CVE-2026-44547

ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

HIGH 76

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00264 Published 2026-05-12 Fixed in 7.3.1 CWE-287

TI-2026-30599 CVE-2026-42288

ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD

HIGH 82

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00715 Published 2026-05-12 Fixed in 7.3.2 CWE-94

TI-2026-30600 CVE-2026-42289

ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00153 Published 2026-05-12 Fixed in 7.3.2 CWE-269

TI-2026-29329 CVE-2026-40593

ChurchCRM: Stored XSS in UserEditor.php via Login Name Field

LOW 21

ChurchCRM is an open-source church management system.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.002 Published 2026-04-18 Fixed in 7.2.0 CWE-116

TI-2026-29317 CVE-2026-40581

ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion

HIGH 68

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00199 Published 2026-04-17 Fixed in 7.2.0 CWE-352

TI-2026-29236 CVE-2026-40485

ChurchCRM: Username Enumeration via Differential Response in Public Login API

MEDIUM 63

ChurchCRM is an open-source church management system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00335 Published 2026-04-17 Fixed in 7.2.0 CWE-204

TI-2026-29235 CVE-2026-40484

ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00867 Published 2026-04-17 Fixed in 7.2.0 CWE-269

TI-2026-29234 CVE-2026-40483

ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field

MEDIUM 58

ChurchCRM is an open-source church management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00224 Published 2026-04-17 Fixed in 7.2.0 CWE-116

TI-2026-29318 CVE-2026-40582

ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout

HIGH 74

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00502 Published 2026-04-17 Fixed in 7.2.0 CWE-288

TI-2026-29231 CVE-2026-40480

ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00402 Published 2026-04-17 Fixed in 7.2.0 CWE-639

TI-2026-29233 CVE-2026-40482

ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`

LOW 31

ChurchCRM is an open-source church management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00311 Published 2026-04-17 Fixed in 7.2.0 CWE-89

TI-2026-28803 CVE-2026-39940

ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php

LOW 24

ChurchCRM is an open-source church management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-04-13 Fixed in 7.0.0 CWE-601

TI-2026-28804 CVE-2026-39941

ChurchCRM has an XSS vulnerability

MEDIUM 57

ChurchCRM is an open-source church management system.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00274 Published 2026-04-09 Fixed in 7.1.0 CWE-79

TI-2026-28325 CVE-2026-39337

ChurchCRM Affected by Unauthenticated RCE in Install Wizard

HIGH 82

ChurchCRM is an open-source church management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00727 Published 2026-04-07 Fixed in 7.1.0 CWE-94

TI-2026-28308 CVE-2026-39319

ChurchCRM has a Second Order SQLI via FundRaiserEditor.php

HIGH 73

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00248 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28332 CVE-2026-39344

Reflected XSS the login page through the 'username' parameter

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.00244 Published 2026-04-07 Fixed in 7.1.0 CWE-79

TI-2026-28331 CVE-2026-39343

ChurchCRM has a SQL Injection in Event Type Editor (Admin)

HIGH 67

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00259 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28330 CVE-2026-39342

ChurchCRM has a SQL injection searchwhat parameter via QueryView.php

HIGH 76

ChurchCRM is an open-source church management system.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00321 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28329 CVE-2026-39341

SQL injection in ChurchCRM.0

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00285 Published 2026-04-07 Fixed in 7.1.0 CWE-89

TI-2026-28328 CVE-2026-39340

ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution

HIGH 70

ChurchCRM is an open-source church management system.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0023 Published 2026-04-07 Fixed in 7.1.0 CWE-89

Vulnerabilities

Filters