Churchcrm vulnerabilities
76 CVEs and advisories name Churchcrm as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-58411ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
- CVE-2026-58410ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records
- CVE-2026-58409ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload
- CVE-2026-58408ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII
- CVE-2026-44548ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
- CVE-2026-44547ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2
- CVE-2026-42288ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD
- CVE-2026-42289ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation
- CVE-2026-40593ChurchCRM: Stored XSS in UserEditor.php via Login Name Field
- CVE-2026-40581ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion
- CVE-2026-40485ChurchCRM: Username Enumeration via Differential Response in Public Login API
- CVE-2026-40484ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function
- CVE-2026-40483ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field
- CVE-2026-40582ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout
- CVE-2026-40480ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`
- CVE-2026-40482ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`
- CVE-2026-39940ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php
- CVE-2026-39941ChurchCRM has an XSS vulnerability
- CVE-2026-39337ChurchCRM Affected by Unauthenticated RCE in Install Wizard
- CVE-2026-39319ChurchCRM has a Second Order SQLI via FundRaiserEditor.php
- CVE-2026-39344Reflected XSS the login page through the 'username' parameter
- CVE-2026-39343ChurchCRM has a SQL Injection in Event Type Editor (Admin)
- CVE-2026-39342ChurchCRM has a SQL injection searchwhat parameter via QueryView.php
- CVE-2026-39341SQL injection in ChurchCRM.0
- CVE-2026-39340ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution
- CVE-2026-39339ChurchCRM has an API Authentication Bypass
- CVE-2026-39338ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
- CVE-2026-39336ChurchCRM has Stored XSS from unescaped config values in HTML attributes
- CVE-2026-39334ChurchCRM has a Blind SQL injection in SettingsIndividual.php
- CVE-2026-39333ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php