Skip to contentChurchcrm vulnerabilities
Newest
- churchcrm, churchcrm crm +1 moreChurchCRM has a Blind SQL injection in PropertyTypeEditor.phpCVE-2026-393268.8 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a Blind SQL injection in SettingsUser.phpCVE-2026-393257.2 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.phpCVE-2026-393188.8 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family ControlsCVE-2026-393356.1 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpCVE-2026-355768.7 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS in Group NameCVE-2026-355758.0 High
- churchcrm, churchcrm crm +1 moreSSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hostsCVE-2026-355727.0 High
- churchcrm, churchcrm crm +1 moreChurchCRM has a Path traversal leads to RCECVE-2026-355739.1 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has a Stored XSS in Person Profile - Add a NoteCVE-2026-355747.3 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionCVE-2026-355347.6 High
- churchcrm, churchcrm crm +1 moreChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.phpCVE-2026-328806.4 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.phpCVE-2026-260592.1 Low
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account TakeoverCVE-2026-248557.2 High
- churchcrm, churchcrm crm +1 moreChurch CRM has SQL injection in PaddleNumEditor.phpCVE-2026-24854Public exploit8.8 High
- churchcrm crm, dolibarr erp\/crm +1 moreDolibarr ERP-CRM 14.0.2 - Stored Cross-Site Scripting (XSS) / Privilege EscalationCVE-2021-477798.4 High
- churchcrm crmFrappe CRM vulnerable to authenticated XSS via website fieldCVE-2025-689285.4 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to Stored XSS - Group name > Person ListingCVE-2025-682759.2 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeoverCVE-2025-684016.2 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.phpCVE-2025-68400Public exploit9.3 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.phpCVE-2025-683992.0 Low
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL injection in EditEventAttendees.phpCVE-2025-681129.6 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in eGive Import FeatureCVE-2025-681117.2 High
- churchcrm, churchcrm crm +1 moreChurchCRM discloses database information on error messageCVE-2025-6811010.0 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to RCE with database restore functionalityCVE-2025-68109Public exploit9.1 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM SQL Injection VulnerabilityCVE-2025-678777.4 High
- churchcrm, churchcrm crm +1 moreChurchCRM has Stored XSS in Group Role Name Leading to Admin Session HijackingCVE-2025-67876Public exploit9.3 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session HijackingCVE-2025-67875Public exploit8.5 High
- churchcrm, churchcrm crm +1 moreChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access ControlCVE-2025-663978.3 High
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in User Editor via `type` Parameter KeyCVE-2025-663967.2 High
- churchcrm, churchcrm crm +1 moreSQL Injection in Event List via `WhichType` ParameterCVE-2025-663958.8 High
- churchcrm, churchcrm crm +1 moreChurchCRM has unauthenticated RCE in its Install WizardCVE-2025-62521Public exploit10.0 Critical
- churchcrm, churchcrm crm +1 moreChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete FixCVE-2025-677517.2 High
- churchcrm, churchcrm crm +1 moreChurchCRM has plaintext password return in responseCVE-2025-678746.9 Medium
- chanjet crmChanjet CRM jxf_dump_table_demo.php sql injectionCVE-2025-141896.9 Medium
- churchcrm, churchcrm crm +1 moreChurchCRM vulnerable to a time-based blind SQL injection via the 1FieldSec parameterCVE-2025-663135.1 Medium
- chanjet crmChanjet CRM upgradeattribute.php sql injectionCVE-2025-137886.9 Medium
- churchcrmChurchCRM Backup Restore RestoreJob.php path traversalCVE-2025-119395.1 Medium
- churchcrmChurchCRM setup.php deserializationCVE-2025-119386.3 Medium
- churchcrmChurchCRM API Endpoint AuthMiddleware.php AuthMiddleware missing authenticationCVE-2025-115296.9 Medium
- chanjet crmChanjet CRM Login Page mailinactive.php sql injectionCVE-2025-79156.9 Medium
- bosssoft crmBossSoft CRM HNDCBas_customPrmSearchDtl.jsp sql injectionCVE-2025-78016.9 Medium
- chanjet crmChanjet CRM departmentsetting.php sql injectionCVE-2025-61326.9 Medium
- chanjet crm, cms +1 moreChanjet CRM newActivityedit.php sql injectionCVE-2025-51525.3 Medium
- churchcrmChurchCRM Referer server-side request forgeryCVE-2025-39546.3 Medium
- churchcrm crmvTiger CRM index.php cross site scriptingCVE-2025-16185.3 Medium
- churchcrmSQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpCVE-2025-11359.3 Critical
- churchcrmSQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpCVE-2025-11349.3 Critical
- churchcrmSQL Injection in ChurchCRM EID Parameter via EditEventAttendees.phpCVE-2025-11339.3 Critical
- churchcrmSQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.phpCVE-2025-11329.3 Critical
- churchcrmSession Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID ParameterCVE-2025-10248.4 High
- Show moreLoading…