ChurchCRM CRM

• CVE-2026-58411 High 7.0 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values 0.4%
• CVE-2026-58410 High 7.1 ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records 0.2%
• CVE-2026-58409 Critical 9.1 ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload 0.6%
• CVE-2026-58408 Medium 6.5 ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII 0.4%
• CVE-2026-44548 High 8.1 ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php) 0.1%
• CVE-2026-44547 Critical 9.6 ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2 0.3%
• CVE-2026-42288 Critical 10.0 ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD 0.7%
• CVE-2026-42289 High 8.8 ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation 0.2%
• CVE-2026-40593 Medium 4.8 ChurchCRM: Stored XSS in UserEditor.php via Login Name Field 0.2%
• CVE-2026-40581 High 8.1 ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion 0.2%
• CVE-2026-40485 Medium 5.3 ChurchCRM: Username Enumeration via Differential Response in Public Login API 0.3%
• CVE-2026-40484 Critical 9.1 ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function 0.9%
• CVE-2026-40483 Medium 5.4 ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field 0.2%
• CVE-2026-40582 Critical 9.1 ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout 0.5%
• CVE-2026-40480 High 7.1 ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` 0.4%
• CVE-2026-40482 High 7.1 ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}` 0.3%
• CVE-2026-39940 Medium 5.3 ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php 0.3%
• CVE-2026-39941 Medium 5.3 ChurchCRM has an XSS vulnerability 0.3%
• CVE-2026-39337 Critical 10.0 ChurchCRM Affected by Unauthenticated RCE in Install Wizard 0.7%
• CVE-2026-39319 High 8.8 ChurchCRM has a Second Order SQLI via FundRaiserEditor.php 0.2%
• CVE-2026-39344 High 8.1 Reflected XSS the login page through the 'username' parameter 0.2%
• CVE-2026-39343 High 7.2 ChurchCRM has a SQL Injection in Event Type Editor (Admin) 0.3%
• CVE-2026-39342 High 8.8 ChurchCRM has a SQL injection searchwhat parameter via QueryView.php 0.3%
• CVE-2026-39341 High 8.1 SQL injection in ChurchCRM.0 0.3%
• CVE-2026-39340 High 8.1 ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution 0.2%
• CVE-2026-39339 Critical 9.1 ChurchCRM has an API Authentication Bypass 1.4%
• CVE-2026-39338 Medium 6.1 ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration 0.2%
• CVE-2026-39336 Medium 6.1 ChurchCRM has Stored XSS from unescaped config values in HTML attributes 0.2%
• CVE-2026-39334 High 8.8 ChurchCRM has a Blind SQL injection in SettingsIndividual.php 0.3%
• CVE-2026-39333 High 8.7 ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php 0.2%
• CVE-2026-39332 High 8.7 ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php 0.2%
• CVE-2026-39331 High 8.1 ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families 0.2%
• CVE-2026-39330 High 8.8 ChurchCRM has a Blind SQL injection in PropertyAssign.php 0.2%
• CVE-2026-39329 High 8.8 ChurchCRM has a Blind SQL injection in EventNames.php 0.2%
• CVE-2026-39328 High 8.9 ChurchCRM has Stored XSS in Social Profile Fields 0.2%
• CVE-2026-39327 High 8.8 ChurchCRM has a SQL injection in MemberRoleChange.php 0.2%
• CVE-2026-39326 High 8.8 ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php 0.2%
• CVE-2026-39325 High 7.2 ChurchCRM has a Blind SQL injection in SettingsUser.php 0.3%
• CVE-2026-39318 High 8.8 ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php 0.3%
• CVE-2026-39335 Medium 6.1 ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls 0.3%
• CVE-2026-35576 High 8.7 ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php 0.3%
• CVE-2026-35575 High 8.0 ChurchCRM has Stored XSS in Group Name 0.3%
• CVE-2026-35572 High 7.0 SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts 0.3%
• CVE-2026-35573 Critical 9.1 ChurchCRM has a Path traversal leads to RCE 0.8%
• CVE-2026-35574 High 7.3 ChurchCRM has a Stored XSS in Person Profile - Add a Note 0.3%
• CVE-2026-35534 High 7.6 ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection 0.2%
• CVE-2026-32880 Medium 6.4 ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php 0.3%
• CVE-2026-26059 Low 2.1 ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php 0.2%
• CVE-2026-24855 High 7.2 ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover 0.2%
• CVE-2026-24854 High 8.8 Church CRM has SQL injection in PaddleNumEditor.php 0.4%