agentprime: crm

agentprime: crmEvery new CVE for crm.https://agentprime.io/CVE-2026-58411: ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and valueshttps://agentprime.io/advisories/CVE-2026-58411/https://agentprime.io/advisories/CVE-2026-58411/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Jul 2026 21:05:18 GMTCVECVE-2026-58410: ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ recordshttps://agentprime.io/advisories/CVE-2026-58410/https://agentprime.io/advisories/CVE-2026-58410/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Jul 2026 20:26:17 GMTCVECVE-2026-58409: ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Uploadhttps://agentprime.io/advisories/CVE-2026-58409/https://agentprime.io/advisories/CVE-2026-58409/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Jul 2026 20:05:56 GMTCVEcriticalCVE-2026-58408: ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PIIhttps://agentprime.io/advisories/CVE-2026-58408/https://agentprime.io/advisories/CVE-2026-58408/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Jul 2026 19:43:48 GMTCVECVE-2026-44548: ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)https://agentprime.io/advisories/CVE-2026-44548/https://agentprime.io/advisories/CVE-2026-44548/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 May 2026 22:33:34 GMTCVECVE-2026-44547: ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2https://agentprime.io/advisories/CVE-2026-44547/https://agentprime.io/advisories/CVE-2026-44547/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 May 2026 22:30:15 GMTCVEcriticalCVE-2026-42288: ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORDhttps://agentprime.io/advisories/CVE-2026-42288/https://agentprime.io/advisories/CVE-2026-42288/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 May 2026 22:25:33 GMTCVEcriticalCVE-2026-42289: ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalationhttps://agentprime.io/advisories/CVE-2026-42289/https://agentprime.io/advisories/CVE-2026-42289/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 12 May 2026 22:23:25 GMTCVECVE-2026-40593: ChurchCRM: Stored XSS in UserEditor.php via Login Name Fieldhttps://agentprime.io/advisories/CVE-2026-40593/https://agentprime.io/advisories/CVE-2026-40593/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 18 Apr 2026 00:02:59 GMTCVECVE-2026-40581: ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletionhttps://agentprime.io/advisories/CVE-2026-40581/https://agentprime.io/advisories/CVE-2026-40581/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 23:51:32 GMTCVECVE-2026-40485: ChurchCRM: Username Enumeration via Differential Response in Public Login APIhttps://agentprime.io/advisories/CVE-2026-40485/https://agentprime.io/advisories/CVE-2026-40485/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 23:29:35 GMTCVECVE-2026-40484: ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Functionhttps://agentprime.io/advisories/CVE-2026-40484/https://agentprime.io/advisories/CVE-2026-40484/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 23:25:06 GMTCVEcriticalCVE-2026-40483: ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Fieldhttps://agentprime.io/advisories/CVE-2026-40483/https://agentprime.io/advisories/CVE-2026-40483/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 23:20:44 GMTCVECVE-2026-40582: ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockouthttps://agentprime.io/advisories/CVE-2026-40582/https://agentprime.io/advisories/CVE-2026-40582/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 23:16:13 GMTCVEcriticalCVE-2026-40480: ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`https://agentprime.io/advisories/CVE-2026-40480/https://agentprime.io/advisories/CVE-2026-40480/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 23:07:30 GMTCVECVE-2026-40482: ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`https://agentprime.io/advisories/CVE-2026-40482/https://agentprime.io/advisories/CVE-2026-40482/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 22:58:48 GMTCVECVE-2026-39940: ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.phphttps://agentprime.io/advisories/CVE-2026-39940/https://agentprime.io/advisories/CVE-2026-39940/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 16:34:58 GMTCVECVE-2026-39941: ChurchCRM has an XSS vulnerabilityhttps://agentprime.io/advisories/CVE-2026-39941/https://agentprime.io/advisories/CVE-2026-39941/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 09 Apr 2026 15:38:07 GMTCVECVE-2026-39337: ChurchCRM Affected by Unauthenticated RCE in Install Wizardhttps://agentprime.io/advisories/CVE-2026-39337/https://agentprime.io/advisories/CVE-2026-39337/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:08:27 GMTCVEcriticalCVE-2026-39319: ChurchCRM has a Second Order SQLI via FundRaiserEditor.phphttps://agentprime.io/advisories/CVE-2026-39319/https://agentprime.io/advisories/CVE-2026-39319/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:05:18 GMTCVECVE-2026-39344: Reflected XSS the login page through the 'username' parameterhttps://agentprime.io/advisories/CVE-2026-39344/https://agentprime.io/advisories/CVE-2026-39344/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:04:24 GMTCVECVE-2026-39343: ChurchCRM has a SQL Injection in Event Type Editor (Admin)https://agentprime.io/advisories/CVE-2026-39343/https://agentprime.io/advisories/CVE-2026-39343/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:03:25 GMTCVECVE-2026-39342: ChurchCRM has a SQL injection searchwhat parameter via QueryView.phphttps://agentprime.io/advisories/CVE-2026-39342/https://agentprime.io/advisories/CVE-2026-39342/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:02:40 GMTCVEcriticalCVE-2026-39341: SQL injection in ChurchCRM.0https://agentprime.io/advisories/CVE-2026-39341/https://agentprime.io/advisories/CVE-2026-39341/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:01:42 GMTCVECVE-2026-39340: ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitutionhttps://agentprime.io/advisories/CVE-2026-39340/https://agentprime.io/advisories/CVE-2026-39340/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 18:00:09 GMTCVECVE-2026-39339: ChurchCRM has an API Authentication Bypasshttps://agentprime.io/advisories/CVE-2026-39339/https://agentprime.io/advisories/CVE-2026-39339/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:58:50 GMTCVEcriticalCVE-2026-39338: ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltrationhttps://agentprime.io/advisories/CVE-2026-39338/https://agentprime.io/advisories/CVE-2026-39338/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:57:30 GMTCVECVE-2026-39336: ChurchCRM has Stored XSS from unescaped config values in HTML attributeshttps://agentprime.io/advisories/CVE-2026-39336/https://agentprime.io/advisories/CVE-2026-39336/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:40:55 GMTCVECVE-2026-39334: ChurchCRM has a Blind SQL injection in SettingsIndividual.phphttps://agentprime.io/advisories/CVE-2026-39334/https://agentprime.io/advisories/CVE-2026-39334/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:38:45 GMTCVECVE-2026-39333: ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.phphttps://agentprime.io/advisories/CVE-2026-39333/https://agentprime.io/advisories/CVE-2026-39333/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:38:02 GMTCVECVE-2026-39332: ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.phphttps://agentprime.io/advisories/CVE-2026-39332/https://agentprime.io/advisories/CVE-2026-39332/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:37:23 GMTCVECVE-2026-39331: ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Familieshttps://agentprime.io/advisories/CVE-2026-39331/https://agentprime.io/advisories/CVE-2026-39331/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:36:41 GMTCVECVE-2026-39330: ChurchCRM has a Blind SQL injection in PropertyAssign.phphttps://agentprime.io/advisories/CVE-2026-39330/https://agentprime.io/advisories/CVE-2026-39330/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:34:30 GMTCVECVE-2026-39329: ChurchCRM has a Blind SQL injection in EventNames.phphttps://agentprime.io/advisories/CVE-2026-39329/https://agentprime.io/advisories/CVE-2026-39329/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:33:30 GMTCVECVE-2026-39328: ChurchCRM has Stored XSS in Social Profile Fieldshttps://agentprime.io/advisories/CVE-2026-39328/https://agentprime.io/advisories/CVE-2026-39328/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:32:41 GMTCVECVE-2026-39327: ChurchCRM has a SQL injection in MemberRoleChange.phphttps://agentprime.io/advisories/CVE-2026-39327/https://agentprime.io/advisories/CVE-2026-39327/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:31:37 GMTCVECVE-2026-39326: ChurchCRM has a Blind SQL injection in PropertyTypeEditor.phphttps://agentprime.io/advisories/CVE-2026-39326/https://agentprime.io/advisories/CVE-2026-39326/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:30:57 GMTCVECVE-2026-39325: ChurchCRM has a Blind SQL injection in SettingsUser.phphttps://agentprime.io/advisories/CVE-2026-39325/https://agentprime.io/advisories/CVE-2026-39325/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:29:19 GMTCVECVE-2026-39318: ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.phphttps://agentprime.io/advisories/CVE-2026-39318/https://agentprime.io/advisories/CVE-2026-39318/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:27:51 GMTCVECVE-2026-39335: ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controlshttps://agentprime.io/advisories/CVE-2026-39335/https://agentprime.io/advisories/CVE-2026-39335/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:23:08 GMTCVECVE-2026-35576: ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phphttps://agentprime.io/advisories/CVE-2026-35576/https://agentprime.io/advisories/CVE-2026-35576/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:11:24 GMTCVECVE-2026-35575: ChurchCRM has Stored XSS in Group Namehttps://agentprime.io/advisories/CVE-2026-35575/https://agentprime.io/advisories/CVE-2026-35575/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:08:43 GMTCVECVE-2026-35572: SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hostshttps://agentprime.io/advisories/CVE-2026-35572/https://agentprime.io/advisories/CVE-2026-35572/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:07:57 GMTCVECVE-2026-35573: ChurchCRM has a Path traversal leads to RCEhttps://agentprime.io/advisories/CVE-2026-35573/https://agentprime.io/advisories/CVE-2026-35573/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:06:07 GMTCVEcriticalCVE-2026-35574: ChurchCRM has a Stored XSS in Person Profile - Add a Notehttps://agentprime.io/advisories/CVE-2026-35574/https://agentprime.io/advisories/CVE-2026-35574/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 17:04:21 GMTCVECVE-2026-35534: ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injectionhttps://agentprime.io/advisories/CVE-2026-35534/https://agentprime.io/advisories/CVE-2026-35534/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 15:47:44 GMTCVECVE-2026-32880: ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.phphttps://agentprime.io/advisories/CVE-2026-32880/https://agentprime.io/advisories/CVE-2026-32880/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 20 Mar 2026 01:04:08 GMTCVECVE-2026-26059: ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.phphttps://agentprime.io/advisories/CVE-2026-26059/https://agentprime.io/advisories/CVE-2026-26059/CVSS 2.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 19 Feb 2026 18:45:53 GMTCVECVE-2026-24855: ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeoverhttps://agentprime.io/advisories/CVE-2026-24855/https://agentprime.io/advisories/CVE-2026-24855/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Jan 2026 15:08:31 GMTCVECVE-2026-24854: Church CRM has SQL injection in PaddleNumEditor.phphttps://agentprime.io/advisories/CVE-2026-24854/https://agentprime.io/advisories/CVE-2026-24854/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Jan 2026 15:05:12 GMTCVE