← Back

Churchcrm

churchcrm

110 CVEs • 1 product

Products (1)

Click to collapse
Toggle
Churchcrm
churchcrm
110 CVEs

CVEs (110)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-38767
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php.
CVE-2023-38766
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.
CVE-2023-38765
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php.
CVE-2023-38764
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php.
CVE-2023-38763
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.
CVE-2023-38762
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php.
CVE-2023-38761
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.
CVE-2023-38760
1Churchcrm
1Churchcrm
Jun 17, 2026
Aug 8, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component.
CVE-2023-33661
1Churchcrm
1Churchcrm
Jun 17, 2026
Jun 29, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
CVE-2023-31548
1Churchcrm
1Churchcrm
Jun 17, 2026
May 31, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2023-26842
1Churchcrm
1Churchcrm
Jun 17, 2026
May 31, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.
CVE-2023-31699
1Churchcrm
1Churchcrm
Jun 17, 2026
May 17, 2023
N/A· v4
4.8 MEDIUM· v3
N/A· v2
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
CVE-2023-29842
1Churchcrm
1Churchcrm
Jun 17, 2026
May 4, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.
CVE-2023-26843
1Churchcrm
1Churchcrm
Jun 17, 2026
Apr 25, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
CVE-2023-26841
1Churchcrm
1Churchcrm
Jun 17, 2026
Apr 25, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.
CVE-2023-26840
1Churchcrm
1Churchcrm
Jun 17, 2026
Apr 25, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.
CVE-2023-26839
1Churchcrm
1Churchcrm
Jun 17, 2026
Apr 25, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.
CVE-2023-25348
1Churchcrm
1Churchcrm
Jun 17, 2026
Apr 25, 2023
N/A· v4
7.8 HIGH· v3
N/A· v2
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a craf...Show more
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.Show less
CVE-2023-25347
1Churchcrm
1Churchcrm
Jun 17, 2026
Apr 25, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEdi...Show more
A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php.Show less
CVE-2023-25346
1Churchcrm
1Churchcrm
Jun 17, 2026
Apr 25, 2023
N/A· v4
6.1 MEDIUM· v3
N/A· v2
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.