Churchcrm vulnerabilities
76 CVEs and advisories name Churchcrm as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-67875ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking
- CVE-2025-66397ChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access Control
- CVE-2025-66396ChurchCRM has SQL Injection in User Editor via `type` Parameter Key
- CVE-2025-66395SQL Injection in Event List via `WhichType` Parameter
- CVE-2025-62521ChurchCRM has unauthenticated RCE in its Install Wizard
- CVE-2025-67751ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix
- CVE-2025-67874ChurchCRM has plaintext password return in response
- CVE-2025-66313ChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameter
- CVE-2025-1135SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php
- CVE-2025-1134SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php
- CVE-2025-1133SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php
- CVE-2025-1132SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.php
- CVE-2025-1024Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter
- CVE-2025-1023SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php
- CVE-2025-0981Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field
- CVE-2024-39304ChurchCRM SQL Injection Vulnerability