ChurchCRM vulnerabilities

76 published CVEs name ChurchCRM among the affected products.

Newest CVEs

CVE-2026-58411
ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values
ChurchCRM · CRM
High7.0
CVE-2026-58410
ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records
ChurchCRM · CRM
High7.1
CVE-2026-58409
ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload
ChurchCRM · CRM
Critical9.1
CVE-2026-58408
ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII
ChurchCRM · CRM
Medium6.5
CVE-2026-44548
ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)
ChurchCRM · CRM
High8.1
CVE-2026-44547
ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2
ChurchCRM · CRM
Critical9.6
CVE-2026-42288
ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD
ChurchCRM · CRM
Critical10.0
CVE-2026-42289
ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation
ChurchCRM · CRM
High8.8
CVE-2026-40593
ChurchCRM: Stored XSS in UserEditor.php via Login Name Field
ChurchCRM · CRM
Medium4.8
CVE-2026-40581
ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion
ChurchCRM · CRM
High8.1