Skip to content
OpenAdvisories

Vendor

ChurchCRM

76 known vulnerabilities.

Products

CRM 69 ChurchCRM 7
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.6
    CVE-2026-39338 Public exploit

    ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration

    ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prio…

    ChurchCRM CRM
  • High 8.8
    CVE-2026-24854 Public exploit

    Church CRM has SQL injection in PaddleNumEditor.php

    ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection …

    ChurchCRM CRM
  • Critical 9.3
    CVE-2025-68400 Public exploit

    ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php

    ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed an…

    ChurchCRM CRM
  • Critical 9.1
    CVE-2025-68109 Public exploit

    ChurchCRM vulnerable to RCE with database restore functionality

    ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently uploa…

    ChurchCRM CRM
  • Critical 9.3
    CVE-2025-67876 Public exploit

    ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking

    ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allows a low-privilege user with the “Manage Groups” permission to inject persistent JavaScript into grou…

    ChurchCRM CRM
  • High 8.5
    CVE-2025-67875 Public exploit

    ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

    ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can i…

    ChurchCRM CRM
  • Critical 10.0
    CVE-2025-62521 Public exploit

    ChurchCRM has unauthenticated RCE in its Install Wizard

    ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation p…

    ChurchCRM CRM
  • High 8.8
    CVE-2024-39304 Public exploit

    ChurchCRM SQL Injection Vulnerability

    ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessa…

    ChurchCRM CRM