Advisories · Technology
ChurchCRM.
Every CVE that names ChurchCRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
ChurchCRM Backup Restore RestoreJob.php path traversal
- ChurchCRM
- Path traversal
- CVSS 6.3 Medium
ChurchCRM setup.php deserialization
- ChurchCRM
- Insecure deserialization
- CWE-20
- CVSS 6.9 Medium
ChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authentication
- ChurchCRM
- Authentication bypass
- CVSS 6.3 Medium
ChurchCRM Referer server-side request forgery
- ChurchCRM
- Server-side request forgery (SSRF)
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php
- ChurchCRM
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php
- ChurchCRM
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php
- ChurchCRM
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.php
- ChurchCRM
- SQL injection
- CVSS 8.4 High
Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter
- ChurchCRM
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php
- ChurchCRM
- SQL injection
- CVSS 8.4 High
Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field
- ChurchCRM
- Authentication bypass