CChurchCRM

Products

Exploited and recent CVEs

• CVE-2026-58411 High 7.0 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values 0.4%
• CVE-2026-58410 High 7.1 ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records 0.2%
• CVE-2026-58409 Critical 9.1 ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload 0.6%
• CVE-2026-58408 Medium 6.5 ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII 0.4%
• CVE-2026-44548 High 8.1 ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php) 0.1%
• CVE-2026-44547 Critical 9.6 ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2 0.3%
• CVE-2026-42288 Critical 10.0 ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD 0.7%
• CVE-2026-42289 High 8.8 ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation 0.2%
• CVE-2026-40593 Medium 4.8 ChurchCRM: Stored XSS in UserEditor.php via Login Name Field 0.2%
• CVE-2026-40581 High 8.1 ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion 0.2%
• CVE-2026-40485 Medium 5.3 ChurchCRM: Username Enumeration via Differential Response in Public Login API 0.3%
• CVE-2026-40484 Critical 9.1 ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function 0.9%
• CVE-2026-40483 Medium 5.4 ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field 0.2%
• CVE-2026-40582 Critical 9.1 ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout 0.5%
• CVE-2026-40480 High 7.1 ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` 0.4%
• CVE-2026-40482 High 7.1 ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}` 0.3%
• CVE-2026-39940 Medium 5.3 ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php 0.3%
• CVE-2026-39941 Medium 5.3 ChurchCRM has an XSS vulnerability 0.3%
• CVE-2026-39337 Critical 10.0 ChurchCRM Affected by Unauthenticated RCE in Install Wizard 0.7%
• CVE-2026-39319 High 8.8 ChurchCRM has a Second Order SQLI via FundRaiserEditor.php 0.2%
• CVE-2026-39344 High 8.1 Reflected XSS the login page through the 'username' parameter 0.2%
• CVE-2026-39343 High 7.2 ChurchCRM has a SQL Injection in Event Type Editor (Admin) 0.3%
• CVE-2026-39342 High 8.8 ChurchCRM has a SQL injection searchwhat parameter via QueryView.php 0.3%
• CVE-2026-39341 High 8.1 SQL injection in ChurchCRM.0 0.3%
• CVE-2026-39340 High 8.1 ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution 0.2%
• CVE-2026-39339 Critical 9.1 ChurchCRM has an API Authentication Bypass 1.4%
• CVE-2026-39338 Medium 6.1 ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration 0.2%
• CVE-2026-39336 Medium 6.1 ChurchCRM has Stored XSS from unescaped config values in HTML attributes 0.2%
• CVE-2026-39334 High 8.8 ChurchCRM has a Blind SQL injection in SettingsIndividual.php 0.3%
• CVE-2026-39333 High 8.7 ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php 0.2%