Skip to content
Churchcrm vulnerabilities
Newest
-
churchcrm crm
Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-116492
7.1 High
-
churchcrm crm
Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log
CVE-2026-111938
5.3 Medium
-
churchcrm crm
Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records
CVE-2026-111937
5.3 Medium
-
churchcrm crm
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
CVE-2026-108734
5.3 Medium
-
chanjet information technology co., ltd. crm
Chanjet CRM SQL Injection via get_usedspace.php
CVE-2021-48008
8.7 High
-
changeweder crm
ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting
CVE-2026-92418
5.1 Medium
-
changeweder crm
ChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization
CVE-2026-92402
5.3 Medium
-
changeweder crm
ChangeWeDer crm improper authentication
CVE-2026-92401
6.9 Medium
-
churchcrm crm
DefaultFuction CRM delete.php sql injection
CVE-2026-86172
5.3 Medium
-
churchcrm crm
DefaultFuction CRM delete.php sql injection
CVE-2026-86171
5.3 Medium
-
churchcrm crm
DefaultFuction CRM edit.php sql injection
CVE-2026-86170
5.3 Medium
-
churchcrm crm
Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api
CVE-2026-53761
8.2 High
-
chanjet crm
Chanjet CRM jxf_dump_table.php sql injection
CVE-2026-84111
6.9 Medium
-
churchcrm crm
ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
CVE-2026-58411
7.0 High
-
churchcrm crm
ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records
CVE-2026-58410
7.1 High
-
churchcrm crm
ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload
CVE-2026-58409
9.1 Critical
-
churchcrm crm
ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII
CVE-2026-58408
6.5 Medium
-
chanjet crm
Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection
CVE-2026-11456
6.9 Medium
-
churchcrm crm
ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
CVE-2026-44548
8.1 High
-
churchcrm crm
ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2
CVE-2026-44547
9.6 Critical
-
churchcrm crm
ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD
CVE-2026-42288
10.0 Critical
-
churchcrm crm
ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation
CVE-2026-42289
8.8 High
-
churchcrm crm
ChurchCRM: Stored XSS in UserEditor.php via Login Name Field
CVE-2026-40593
4.8 Medium
-
churchcrm crm
ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion
CVE-2026-40581
8.1 High
-
churchcrm crm
ChurchCRM: Username Enumeration via Differential Response in Public Login API
CVE-2026-40485
5.3 Medium
-
churchcrm crm
ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function
CVE-2026-40484
9.1 Critical
-
churchcrm crm
ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field
CVE-2026-40483
5.4 Medium
-
churchcrm crm
ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout
CVE-2026-40582
9.1 Critical
-
churchcrm crm
ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`
CVE-2026-40480
7.1 High
-
churchcrm crm
ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`
CVE-2026-40482
7.1 High
-
churchcrm crm
ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php
CVE-2026-39940
5.3 Medium
-
churchcrm, churchcrm crm +1 more
ChurchCRM has an XSS vulnerability
CVE-2026-39941
5.3 Medium
-
churchcrm, churchcrm crm +1 more
ChurchCRM Affected by Unauthenticated RCE in Install Wizard
CVE-2026-39337
10.0 Critical
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a Second Order SQLI via FundRaiserEditor.php
CVE-2026-39319
8.8 High
-
churchcrm, churchcrm crm +1 more
Reflected XSS the login page through the 'username' parameter
CVE-2026-39344
8.1 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a SQL Injection in Event Type Editor (Admin)
CVE-2026-39343
7.2 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a SQL injection searchwhat parameter via QueryView.php
CVE-2026-39342
9.4 Critical
-
churchcrm, churchcrm crm +1 more
SQL injection in ChurchCRM.0
CVE-2026-39341
8.1 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution
CVE-2026-39340
8.1 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has an API Authentication Bypass
CVE-2026-39339
9.1 Critical
-
churchcrm, churchcrm crm +1 more
ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration
CVE-2026-39338
Public exploit
8.6 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has Stored XSS from unescaped config values in HTML attributes
CVE-2026-39336
6.1 Medium
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a Blind SQL injection in SettingsIndividual.php
CVE-2026-39334
8.8 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php
CVE-2026-39333
8.7 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php
CVE-2026-39332
8.7 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary Families
CVE-2026-39331
8.1 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a Blind SQL injection in PropertyAssign.php
CVE-2026-39330
8.8 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a Blind SQL injection in EventNames.php
CVE-2026-39329
8.8 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has Stored XSS in Social Profile Fields
CVE-2026-39328
8.9 High
-
churchcrm, churchcrm crm +1 more
ChurchCRM has a SQL injection in MemberRoleChange.php
CVE-2026-39327
8.8 High
- Show olderLoading…