churchcrm

Top products

The 15 most recently published vulnerabilities affecting churchcrm.

• CVE-2026-58411ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and valuesJul 13, 2026
• CVE-2026-58410ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records7.1Jul 13, 2026
• CVE-2026-58409ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload9.1Jul 13, 2026
• CVE-2026-58408ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII6.5Jul 13, 2026
• CVE-2026-44548ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)8.1May 12, 2026
• CVE-2026-44547ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.29.6May 12, 2026
• CVE-2026-42288ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD10.0May 12, 2026
• CVE-2026-42289ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation8.8May 12, 2026
• CVE-2026-40593ChurchCRM: Stored XSS in UserEditor.php via Login Name Field4.8Apr 18, 2026
• CVE-2026-40581ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion8.1Apr 17, 2026
• CVE-2026-40485ChurchCRM: Username Enumeration via Differential Response in Public Login API5.3Apr 17, 2026
• CVE-2026-40484ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function9.1Apr 17, 2026
• CVE-2026-40483ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field5.4Apr 17, 2026
• CVE-2026-40582ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account LockoutApr 17, 2026
• CVE-2026-40480ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`Apr 17, 2026