CVEs we hold for Churchcrm
Records whose assigning authority named Churchcrm as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-58411ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and valuesChurchCRM CRM
CVE-2026-58410ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ recordsChurchCRM CRM
CVE-2026-58409ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin UploadChurchCRM CRM
CVE-2026-58408ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PIIChurchCRM CRM
CVE-2026-44548ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)ChurchCRM CRM
CVE-2026-44547ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2ChurchCRM CRM
CVE-2026-42289ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege EscalationChurchCRM CRM
CVE-2026-42288ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORDChurchCRM CRM
CVE-2026-40582ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account LockoutChurchCRM CRM
CVE-2026-40581ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data DeletionChurchCRM CRM
CVE-2026-40485ChurchCRM: Username Enumeration via Differential Response in Public Login APIChurchCRM CRM
CVE-2026-40484ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore FunctionChurchCRM CRM
CVE-2026-40482ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`ChurchCRM CRM
CVE-2026-40480ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`ChurchCRM CRM
CVE-2026-39940ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.phpChurchCRM CRM
CVE-2026-39340ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer SubstitutionChurchCRM CRM
CVE-2026-39338ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session ExfiltrationChurchCRM CRM
CVE-2026-39335ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family ControlsChurchCRM CRM
CVE-2026-39333ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.phpChurchCRM CRM
CVE-2026-39331ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary FamiliesChurchCRM CRM
CVE-2026-35576ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpChurchCRM CRM
CVE-2026-35572SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hostsChurchCRM CRM
CVE-2026-35534ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionChurchCRM CRM
CVE-2026-32880ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.phpChurchCRM CRM
CVE-2026-24855ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account TakeoverChurchCRM CRM
CVE-2025-68401ChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeoverChurchCRM CRM
CVE-2025-68400ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.phpChurchCRM CRM
CVE-2025-67876ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session HijackingChurchCRM CRM
CVE-2025-67875ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session HijackingChurchCRM CRM
CVE-2025-67751ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete FixChurchCRM CRM
CVE-2025-66397ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access ControlChurchCRM CRM
CVE-2025-66313ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameterChurchCRM CRM
CVE-2025-11529ChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authenticationn/a ChurchCRM
CVE-2025-1135SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpChurchCRM
CVE-2025-1134SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpChurchCRM
CVE-2025-1024Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID ParameterChurchCRM
CVE-2025-0981Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldChurchCRM
80 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.