Advisories · Technology
CRM.
Every CVE that names CRM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.5 High
ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking
- CRM
- Cross-site scripting (XSS)
- CVSS 8.3 High
ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control
- CRM
- Broken access control
- CVSS 7.2 High
ChurchCRM has SQL Injection in User Editor via `type` Parameter Key
- CRM
- SQL injection
- CVSS 8.8 High
SQL Injection in Event List via `WhichType` Parameter
- CRM
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
ChurchCRM has unauthenticated RCE in its Install Wizard
- CRM
- Code injection
- CVSS 7.2 High
ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix
- CRM
- SQL injection
- CVSS 6.9 Medium
ChurchCRM has plaintext password return in response
- CRM
- CWE-204
- CVSS 5.1 Medium
ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter
- CRM
- SQL injection
- CVSS 8.8 High
ChurchCRM SQL Injection Vulnerability
- CRM
- SQL injection