Advisories · Technology
CRM.
Every CVE that names CRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.0 High
ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
- CRM
- Cross-site scripting (XSS)
- CVSS 7.1 High
ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records
- CRM
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload
- CRM
- Unrestricted file upload
- CVSS 6.5 Medium
ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII
- CRM
- Broken access control
- CVSS 8.1 High
ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
- CRM
- Cross-site request forgery (CSRF)
- CWE-650
- CVSS 9.6 CriticalCritical · CVSS 9+
ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2
- CRM
- Authentication bypass
- CVSS 10.0 CriticalCritical · CVSS 9+
ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD
- CRM
- Code injection
- CVSS 8.8 High
ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation
- CRM
- Privilege escalation
- Authentication bypass
- CVSS 4.8 Medium
ChurchCRM: Stored XSS in UserEditor.php via Login Name Field
- CRM
- Cross-site scripting (XSS)
- CWE-116
- CVSS 8.1 High
ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion
- CRM
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.3 Medium
ChurchCRM: Username Enumeration via Differential Response in Public Login API
- CRM
- Authentication bypass
- CWE-204
- CVSS 9.1 CriticalCritical · CVSS 9+
ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function
- CRM
- Privilege escalation
- Unrestricted file upload
- CVSS 5.4 Medium
ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field
- CRM
- Cross-site scripting (XSS)
- CWE-116
- CVSS 9.1 CriticalCritical · CVSS 9+
ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout
- CRM
- Authentication bypass
- CWE-305
- CVSS 7.1 High
ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`
- CRM
- Broken access control
- CVSS 7.1 High
ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`
- CRM
- SQL injection
- CVSS 5.3 Medium
ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php
- CRM
- Open redirect
- CVSS 5.3 Medium
ChurchCRM has an XSS vulnerability
- CRM
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
ChurchCRM Affected by Unauthenticated RCE in Install Wizard
- CRM
- Code injection
- CVSS 8.8 High
ChurchCRM has a Second Order SQLI via FundRaiserEditor.php
- CRM
- SQL injection
- CVSS 8.1 High
Reflected XSS the login page through the 'username' parameter
- CRM
- Cross-site scripting (XSS)
- CVSS 7.2 High
ChurchCRM has a SQL Injection in Event Type Editor (Admin)
- CRM
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
ChurchCRM has a SQL injection searchwhat parameter via QueryView.php
- CRM
- SQL injection
- CVSS 8.1 High
SQL injection in ChurchCRM.0
- CRM
- SQL injection
- CVSS 8.1 High
ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution
- CRM
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
ChurchCRM has an API Authentication Bypass
- CRM
- Broken access control
- CVSS 8.6 High
ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
- CRM
- Cross-site scripting (XSS)
- CWE-1004
- CVSS 6.1 Medium
ChurchCRM has Stored XSS from unescaped config values in HTML attributes
- CRM
- Cross-site scripting (XSS)
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in SettingsIndividual.php
- CRM
- SQL injection
- CVSS 8.7 High
ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php
- CRM
- Cross-site scripting (XSS)
- CVSS 8.7 High
ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php
- CRM
- Cross-site scripting (XSS)
- CVSS 8.1 High
ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families
- CRM
- Broken access control
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in PropertyAssign.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in EventNames.php
- CRM
- SQL injection
- CVSS 8.9 High
ChurchCRM has Stored XSS in Social Profile Fields
- CRM
- Cross-site scripting (XSS)
- CVSS 8.8 High
ChurchCRM has a SQL injection in MemberRoleChange.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php
- CRM
- SQL injection
- CVSS 7.2 High
ChurchCRM has a Blind SQL injection in SettingsUser.php
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php
- CRM
- SQL injection
- CVSS 6.1 Medium
ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls
- CRM
- Cross-site scripting (XSS)
- CVSS 8.7 High
ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php
- CRM
- Cross-site scripting (XSS)
- CVSS 8.0 High
ChurchCRM has Stored XSS in Group Name
- CRM
- Cross-site scripting (XSS)
- CWE-1004
- CVSS 7.0 High
SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts
- CRM
- Server-side request forgery (SSRF)
- CVSS 9.1 CriticalCritical · CVSS 9+
ChurchCRM has a Path traversal leads to RCE
- CRM
- Path traversal
- Unrestricted file upload
- CVSS 7.3 High
ChurchCRM has a Stored XSS in Person Profile - Add a Note
- CRM
- Cross-site scripting (XSS)
- CVSS 7.6 High
ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection
- CRM
- Cross-site scripting (XSS)
- CWE-116
- CVSS 6.4 Medium
ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php
- CRM
- Cross-site scripting (XSS)
- CVSS 2.1 Low
ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php
- CRM
- Cross-site scripting (XSS)
- CVSS 7.2 High
ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover
- CRM
- Cross-site scripting (XSS)
- CVSS 8.8 High
Church CRM has SQL injection in PaddleNumEditor.php
- CRM
- SQL injection
- CVSS 9.2 CriticalCritical · CVSS 9+
ChurchCRM vulnerable to Stored XSS - Group name > Person Listing
- CRM
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
ChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeover
- CRM
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php
- CRM
- SQL injection
- CVSS 2.0 Low
ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php
- CRM
- Cross-site scripting (XSS)
- CVSS 9.6 CriticalCritical · CVSS 9+
ChurchCRM has SQL injection in EditEventAttendees.php
- CRM
- SQL injection
- CVSS 7.2 High
ChurchCRM has SQL Injection in eGive Import Feature
- CRM
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
ChurchCRM discloses database information on error message
- CRM
- Information disclosure
- CVSS 9.1 CriticalCritical · CVSS 9+
ChurchCRM vulnerable to RCE with database restore functionality
- CRM
- Command injection
- Unrestricted file upload
- CVSS 7.4 High
ChurchCRM SQL Injection Vulnerability
- CRM
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking
- CRM
- Cross-site scripting (XSS)