ChurchCRM CRM

• CVE-2025-68275 Critical 9.2 ChurchCRM vulnerable to Stored XSS - Group name > Person Listing 0.2%
• CVE-2025-68401 Medium 6.2 ChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeover 0.2%
• CVE-2025-68400 Critical 9.3 ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php 0.4%
• CVE-2025-68399 Low 2.0 ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php 0.2%
• CVE-2025-68112 Critical 9.6 ChurchCRM has SQL injection in EditEventAttendees.php 0.4%
• CVE-2025-68111 High 7.2 ChurchCRM has SQL Injection in eGive Import Feature 0.4%
• CVE-2025-68110 Critical 10.0 ChurchCRM discloses database information on error message 0.4%
• CVE-2025-68109 Critical 9.1 ChurchCRM vulnerable to RCE with database restore functionality 1.5%
• CVE-2025-67877 High 7.4 ChurchCRM SQL Injection Vulnerability 0.4%
• CVE-2025-67876 Critical 9.3 ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking 0.2%
• CVE-2025-67875 High 8.5 ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking 0.2%
• CVE-2025-66397 High 8.3 ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control 0.3%
• CVE-2025-66396 High 7.2 ChurchCRM has SQL Injection in User Editor via `type` Parameter Key 0.4%
• CVE-2025-66395 High 8.8 SQL Injection in Event List via `WhichType` Parameter 0.4%
• CVE-2025-62521 Critical 10.0 ChurchCRM has unauthenticated RCE in its Install Wizard 4.5%
• CVE-2025-67751 High 7.2 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix 0.4%
• CVE-2025-67874 Medium 6.9 ChurchCRM has plaintext password return in response 0.4%
• CVE-2025-66313 Medium 5.1 ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter 0.4%
• CVE-2024-39304 High 8.8 ChurchCRM SQL Injection Vulnerability 3.0%