Skip to contentChurchcrm Crm vulnerabilities
- churchcrm crmFrappe CRM before 1.89.1 Missing Authorization via Phone Lookup APICVE-2026-1164927.1 High
- churchcrm crmFrappe CRM before 1.74.0 Missing Authorization via add_note_to_call_logCVE-2026-1119385.3 Medium
- churchcrm crmFrappe CRM before 1.81.2 Missing Authorization on CRM Notification RecordsCVE-2026-1119375.3 Medium
- churchcrm crmFrappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_documentCVE-2026-1087345.3 Medium
- chanjet information technology co., ltd. crmChanjet CRM SQL Injection via get_usedspace.phpCVE-2021-480088.7 High
- changeweder crmChangeWeDer crm Save Endpoint customer.serve.js cross site scriptingCVE-2026-924185.1 Medium
- changeweder crmChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorizationCVE-2026-924025.3 Medium
- changeweder crmChangeWeDer crm improper authenticationCVE-2026-924016.9 Medium
- churchcrm crmDefaultFuction CRM delete.php sql injectionCVE-2026-861725.3 Medium
- churchcrm crmDefaultFuction CRM delete.php sql injectionCVE-2026-861715.3 Medium
- churchcrm crmDefaultFuction CRM edit.php sql injectionCVE-2026-861705.3 Medium
- churchcrm crmFrappe CRM: Authentication Bypass via Logged Invitation Keys in crm/apiCVE-2026-537618.2 High
- chanjet crmChanjet CRM jxf_dump_table.php sql injectionCVE-2026-841116.9 Medium
- churchcrm crmChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and valuesCVE-2026-584117.0 High
- churchcrm crmChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ recordsCVE-2026-584107.1 High
- churchcrm crmChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin UploadCVE-2026-584099.1 Critical
- churchcrm crmChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PIICVE-2026-584086.5 Medium
- chanjet crmChanjet CRM HTTP GET Request jxf_dump_systable.php sql injectionCVE-2026-114566.9 Medium
- churchcrm crmChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)CVE-2026-445488.1 High
- churchcrm crmChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2CVE-2026-445479.6 Critical
- churchcrm crmChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORDCVE-2026-4228810.0 Critical
- churchcrm crmChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege EscalationCVE-2026-422898.8 High
- churchcrm crmChurchCRM: Stored XSS in UserEditor.php via Login Name FieldCVE-2026-405934.8 Medium
- churchcrm crmChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data DeletionCVE-2026-405818.1 High
- churchcrm crmChurchCRM: Username Enumeration via Differential Response in Public Login APICVE-2026-404855.3 Medium
- churchcrm crmChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore FunctionCVE-2026-404849.1 Critical
- churchcrm crmChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment FieldCVE-2026-404835.4 Medium
- churchcrm crmChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account LockoutCVE-2026-405829.1 Critical
- churchcrm crmChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`CVE-2026-404807.1 High
- churchcrm crmChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`CVE-2026-404827.1 High
- churchcrm crmChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.phpCVE-2026-399405.3 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has an XSS vulnerabilityCVE-2026-399415.3 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM Affected by Unauthenticated RCE in Install WizardCVE-2026-3933710.0 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has a Second Order SQLI via FundRaiserEditor.phpCVE-2026-393198.8 High
- churchcrm, churchcrm crm +1 moreReflected XSS the login page through the 'username' parameterCVE-2026-393448.1 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a SQL Injection in Event Type Editor (Admin)CVE-2026-393437.2 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a SQL injection searchwhat parameter via QueryView.phpCVE-2026-393429.4 Critical
- churchcrm, churchcrm crm +1 moreSQL injection in ChurchCRM.0CVE-2026-393418.1 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer SubstitutionCVE-2026-393408.1 High
- churchcrm, churchcrm crm +1 moreChurchCRM has an API Authentication BypassCVE-2026-393399.1 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has Blind XSS via Global Search – Administrative Cookie Session ExfiltrationCVE-2026-39338Public exploit8.6 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS from unescaped config values in HTML attributesCVE-2026-393366.1 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has a Blind SQL injection in SettingsIndividual.phpCVE-2026-393348.8 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.phpCVE-2026-393338.7 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.phpCVE-2026-393328.7 High
- churchcrm, churchcrm crm +1 moreChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary FamiliesCVE-2026-393318.1 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a Blind SQL injection in PropertyAssign.phpCVE-2026-393308.8 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a Blind SQL injection in EventNames.phpCVE-2026-393298.8 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS in Social Profile FieldsCVE-2026-393288.9 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a SQL injection in MemberRoleChange.phpCVE-2026-393278.8 High
- Show olderLoading…