Churchcrm
Page 2 of 2 — Churchcrm CVEs from a corpus of 127, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38764 | High | 7.5 | 2023-08-08 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /… |
CVE-2023-38763 | Medium | 6.5 | 2023-08-08 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiser… |
CVE-2023-38762 | High | 7.5 | 2023-08-08 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView… |
CVE-2023-38761 | Medium | 6.1 | 2023-08-08 | Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.ph… |
CVE-2023-38760 | High | 7.5 | 2023-08-08 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryV… |
CVE-2023-33661 | Medium | 6.1 | 2023-06-29 | Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameter… |
CVE-2023-31548 | Medium | 5.4 | 2023-05-31 | A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts o… |
CVE-2023-26842 | Medium | 5.4 | 2023-05-31 | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. |
CVE-2023-31699 | Medium | 4.8 | 2023-05-17 | ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file. |
CVE-2023-29842 | High | 8.8 | 2023-05-04 | ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter. |
CVE-2023-26843 | Medium | 5.4 | 2023-04-25 | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. |
CVE-2023-26841 | Medium | 6.5 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logg… |
CVE-2023-26840 | Medium | 5.3 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. |
CVE-2023-26839 | Medium | 4.3 | 2023-04-25 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. |
CVE-2023-25348 | High | 7.8 | 2023-04-25 | ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnera… |
CVE-2023-25347 | Medium | 5.4 | 2023-04-25 | A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These in… |
CVE-2023-25346 | Medium | 6.1 | 2023-04-25 | A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of… |
CVE-2023-26855 | High | 7.5 | 2023-04-04 | The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack… |
CVE-2023-27059 | Medium | 5.4 | 2023-03-16 | A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2023-24690 | Medium | 5.4 | 2023-02-09 | ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family. |
CVE-2023-24686 | Medium | 4.8 | 2023-02-09 | An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file. |
CVE-2023-24685 | High | 7.2 | 2023-02-09 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module. |
CVE-2023-24684 | High | 7.2 | 2023-02-09 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php. |
CVE-2022-36137 | Medium | 4.8 | 2022-11-29 | ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader. |
CVE-2022-36136 | Medium | 4.8 | 2022-11-29 | ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment. |
CVE-2022-31325 | High | 7.2 | 2022-06-08 | There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php. |
CVE-2021-41965 | High | 8.8 | 2022-05-15 | A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the databas… |