Churchcrm vulnerabilities
76 CVEs and advisories name Churchcrm as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-39332ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php
- CVE-2026-39331ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families
- CVE-2026-39330ChurchCRM has a Blind SQL injection in PropertyAssign.php
- CVE-2026-39329ChurchCRM has a Blind SQL injection in EventNames.php
- CVE-2026-39328ChurchCRM has Stored XSS in Social Profile Fields
- CVE-2026-39327ChurchCRM has a SQL injection in MemberRoleChange.php
- CVE-2026-39326ChurchCRM has a Blind SQL injection in PropertyTypeEditor.php
- CVE-2026-39325ChurchCRM has a Blind SQL injection in SettingsUser.php
- CVE-2026-39318ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php
- CVE-2026-39335ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls
- CVE-2026-35576ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php
- CVE-2026-35575ChurchCRM has Stored XSS in Group Name
- CVE-2026-35572SSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hosts
- CVE-2026-35573ChurchCRM has a Path traversal leads to RCE
- CVE-2026-35574ChurchCRM has a Stored XSS in Person Profile - Add a Note
- CVE-2026-35534ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection
- CVE-2026-32880ChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.php
- CVE-2026-26059ChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.php
- CVE-2026-24855ChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account Takeover
- CVE-2026-24854Church CRM has SQL injection in PaddleNumEditor.php
- CVE-2025-68275ChurchCRM vulnerable to Stored XSS - Group name > Person Listing
- CVE-2025-68401ChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeover
- CVE-2025-68400ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php
- CVE-2025-68399ChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.php
- CVE-2025-68112ChurchCRM has SQL injection in EditEventAttendees.php
- CVE-2025-68111ChurchCRM has SQL Injection in eGive Import Feature
- CVE-2025-68110ChurchCRM discloses database information on error message
- CVE-2025-68109ChurchCRM vulnerable to RCE with database restore functionality
- CVE-2025-67877ChurchCRM SQL Injection Vulnerability
- CVE-2025-67876ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking