# cve.now: Churchcrm

The newest entries naming Churchcrm as an affected vendor (up to 200), of 76 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-58411](https://cve.now/CVE-2026-58411.md): ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values (CVSS 7.0)
- [CVE-2026-58410](https://cve.now/CVE-2026-58410.md): ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records (CVSS 7.1)
- [CVE-2026-58409](https://cve.now/CVE-2026-58409.md): ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload (CVSS 9.1)
- [CVE-2026-58408](https://cve.now/CVE-2026-58408.md): ChurchCRM : Broken Access Control in \`CSVCreateFile.php\` Allows Low-Privileged Users to Export All Members' PII (CVSS 6.5)
- [CVE-2026-44548](https://cve.now/CVE-2026-44548.md): ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php) (CVSS 8.1)
- [CVE-2026-44547](https://cve.now/CVE-2026-44547.md): ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2 (CVSS 9.6)
- [CVE-2026-42288](https://cve.now/CVE-2026-42288.md): ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB\_PASSWORD (CVSS 10.0)
- [CVE-2026-42289](https://cve.now/CVE-2026-42289.md): ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation (CVSS 8.8)
- [CVE-2026-40593](https://cve.now/CVE-2026-40593.md): ChurchCRM: Stored XSS in UserEditor.php via Login Name Field (CVSS 4.8)
- [CVE-2026-40581](https://cve.now/CVE-2026-40581.md): ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion (CVSS 8.1)
- [CVE-2026-40485](https://cve.now/CVE-2026-40485.md): ChurchCRM: Username Enumeration via Differential Response in Public Login API (CVSS 5.3)
- [CVE-2026-40484](https://cve.now/CVE-2026-40484.md): ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function (CVSS 9.1)
- [CVE-2026-40483](https://cve.now/CVE-2026-40483.md): ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field (CVSS 5.4)
- [CVE-2026-40582](https://cve.now/CVE-2026-40582.md): ChurchCRM: Authentication Bypass in \`/api/public/user/login\` Allows Bypass of 2FA and Account Lockout (CVSS 9.1)
- [CVE-2026-40480](https://cve.now/CVE-2026-40480.md): ChurchCRM has Missing Object-Level Authorization / IDOR in \`/api/person/{personId}\` (CVSS 7.1)
- [CVE-2026-40482](https://cve.now/CVE-2026-40482.md): ChurchCRM has Authenticated SQL Injection in \`/api/families/byCheckNumber/{scanString}\` (CVSS 7.1)
- [CVE-2026-39940](https://cve.now/CVE-2026-39940.md): ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php (CVSS 5.3)
- [CVE-2026-39941](https://cve.now/CVE-2026-39941.md): ChurchCRM has an XSS vulnerability (CVSS 5.3)
- [CVE-2026-39337](https://cve.now/CVE-2026-39337.md): ChurchCRM Affected by Unauthenticated RCE in Install Wizard (CVSS 10.0)
- [CVE-2026-39319](https://cve.now/CVE-2026-39319.md): ChurchCRM has a Second Order SQLI via FundRaiserEditor.php (CVSS 8.8)
- [CVE-2026-39344](https://cve.now/CVE-2026-39344.md): Reflected XSS the login page through the 'username' parameter (CVSS 8.1)
- [CVE-2026-39343](https://cve.now/CVE-2026-39343.md): ChurchCRM has a SQL Injection in Event Type Editor (Admin) (CVSS 7.2)
- [CVE-2026-39342](https://cve.now/CVE-2026-39342.md): ChurchCRM has a SQL injection searchwhat parameter via QueryView.php (CVSS 9.4)
- [CVE-2026-39341](https://cve.now/CVE-2026-39341.md): SQL injection in ChurchCRM.0 (CVSS 8.1)
- [CVE-2026-39340](https://cve.now/CVE-2026-39340.md): ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution (CVSS 8.1)
- [CVE-2026-39339](https://cve.now/CVE-2026-39339.md): ChurchCRM has an API Authentication Bypass (CVSS 9.1)
- [CVE-2026-39338](https://cve.now/CVE-2026-39338.md): ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration (CVSS 8.6)
- [CVE-2026-39336](https://cve.now/CVE-2026-39336.md): ChurchCRM has Stored XSS from unescaped config values in HTML attributes (CVSS 6.1)
- [CVE-2026-39334](https://cve.now/CVE-2026-39334.md): ChurchCRM has a Blind SQL injection in SettingsIndividual.php (CVSS 8.8)
- [CVE-2026-39333](https://cve.now/CVE-2026-39333.md): ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php (CVSS 8.7)
- [CVE-2026-39332](https://cve.now/CVE-2026-39332.md): ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php (CVSS 8.7)
- [CVE-2026-39331](https://cve.now/CVE-2026-39331.md): ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families (CVSS 8.1)
- [CVE-2026-39330](https://cve.now/CVE-2026-39330.md): ChurchCRM has a Blind SQL injection in PropertyAssign.php (CVSS 8.8)
- [CVE-2026-39329](https://cve.now/CVE-2026-39329.md): ChurchCRM has a Blind SQL injection in EventNames.php (CVSS 8.8)
- [CVE-2026-39328](https://cve.now/CVE-2026-39328.md): ChurchCRM has Stored XSS in Social Profile Fields (CVSS 8.9)
- [CVE-2026-39327](https://cve.now/CVE-2026-39327.md): ChurchCRM has a SQL injection in MemberRoleChange.php (CVSS 8.8)
- [CVE-2026-39326](https://cve.now/CVE-2026-39326.md): ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php (CVSS 8.8)
- [CVE-2026-39325](https://cve.now/CVE-2026-39325.md): ChurchCRM has a Blind SQL injection in SettingsUser.php (CVSS 7.2)
- [CVE-2026-39318](https://cve.now/CVE-2026-39318.md): ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php (CVSS 8.8)
- [CVE-2026-39335](https://cve.now/CVE-2026-39335.md): ChurchCRM has Stored XSS via Unescaped data-\* Attributes in Group/Family Controls (CVSS 6.1)
- [CVE-2026-35576](https://cve.now/CVE-2026-35576.md): ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php (CVSS 8.7)
- [CVE-2026-35575](https://cve.now/CVE-2026-35575.md): ChurchCRM has Stored XSS in Group Name (CVSS 8.0)
- [CVE-2026-35572](https://cve.now/CVE-2026-35572.md): SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts (CVSS 7.0)
- [CVE-2026-35573](https://cve.now/CVE-2026-35573.md): ChurchCRM has a Path traversal leads to RCE (CVSS 9.1)
- [CVE-2026-35574](https://cve.now/CVE-2026-35574.md): ChurchCRM has a Stored XSS in Person Profile - Add a Note (CVSS 7.3)
- [CVE-2026-35534](https://cve.now/CVE-2026-35534.md): ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection (CVSS 7.6)
- [CVE-2026-32880](https://cve.now/CVE-2026-32880.md): ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php (CVSS 6.4)
- [CVE-2026-26059](https://cve.now/CVE-2026-26059.md): ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php (CVSS 2.1)
- [CVE-2026-24855](https://cve.now/CVE-2026-24855.md): ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover (CVSS 7.2)
- [CVE-2026-24854](https://cve.now/CVE-2026-24854.md): Church CRM has SQL injection in PaddleNumEditor.php (CVSS 8.8)
- [CVE-2025-68275](https://cve.now/CVE-2025-68275.md): ChurchCRM vulnerable to Stored XSS - Group name \> Person Listing (CVSS 9.2)
- [CVE-2025-68401](https://cve.now/CVE-2025-68401.md): ChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeover (CVSS 6.2)
- [CVE-2025-68400](https://cve.now/CVE-2025-68400.md): ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php (CVSS 9.3)
- [CVE-2025-68399](https://cve.now/CVE-2025-68399.md): ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php (CVSS 2.0)
- [CVE-2025-68112](https://cve.now/CVE-2025-68112.md): ChurchCRM has SQL injection in EditEventAttendees.php (CVSS 9.6)
- [CVE-2025-68111](https://cve.now/CVE-2025-68111.md): ChurchCRM has SQL Injection in eGive Import Feature (CVSS 7.2)
- [CVE-2025-68110](https://cve.now/CVE-2025-68110.md): ChurchCRM discloses database information on error message (CVSS 10.0)
- [CVE-2025-68109](https://cve.now/CVE-2025-68109.md): ChurchCRM vulnerable to RCE with database restore functionality (CVSS 9.1)
- [CVE-2025-67877](https://cve.now/CVE-2025-67877.md): ChurchCRM SQL Injection Vulnerability (CVSS 7.4)
- [CVE-2025-67876](https://cve.now/CVE-2025-67876.md): ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking (CVSS 9.3)
- [CVE-2025-67875](https://cve.now/CVE-2025-67875.md): ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking (CVSS 8.5)
- [CVE-2025-66397](https://cve.now/CVE-2025-66397.md): ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control (CVSS 8.3)
- [CVE-2025-66396](https://cve.now/CVE-2025-66396.md): ChurchCRM has SQL Injection in User Editor via \`type\` Parameter Key (CVSS 7.2)
- [CVE-2025-66395](https://cve.now/CVE-2025-66395.md): SQL Injection in Event List via \`WhichType\` Parameter (CVSS 8.8)
- [CVE-2025-62521](https://cve.now/CVE-2025-62521.md): ChurchCRM has unauthenticated RCE in its Install Wizard (CVSS 10.0)
- [CVE-2025-67751](https://cve.now/CVE-2025-67751.md): ChurchCRM has SQL Injection in Event Editor via \`EN\_tyid\` Parameter caused by an Incomplete Fix (CVSS 7.2)
- [CVE-2025-67874](https://cve.now/CVE-2025-67874.md): ChurchCRM has plaintext password return in response (CVSS 6.9)
- [CVE-2025-66313](https://cve.now/CVE-2025-66313.md): ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter (CVSS 5.1)
- [CVE-2025-1135](https://cve.now/CVE-2025-1135.md): SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php (CVSS 9.3)
- [CVE-2025-1134](https://cve.now/CVE-2025-1134.md): SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php (CVSS 9.3)
- [CVE-2025-1133](https://cve.now/CVE-2025-1133.md): SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php (CVSS 9.3)
- [CVE-2025-1132](https://cve.now/CVE-2025-1132.md): SQL Injection in ChurchCRM EN\_tyid Parameter via EditEventAttendees.php (CVSS 9.3)
- [CVE-2025-1024](https://cve.now/CVE-2025-1024.md): Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter (CVSS 8.4)
- [CVE-2025-1023](https://cve.now/CVE-2025-1023.md): SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php (CVSS 9.3)
- [CVE-2025-0981](https://cve.now/CVE-2025-0981.md): Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field (CVSS 8.4)
- [CVE-2024-39304](https://cve.now/CVE-2024-39304.md): ChurchCRM SQL Injection Vulnerability (CVSS 8.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/churchcrm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.