Skip to content
OpenAdvisories

Vendor

ChurchCRM

76 known vulnerabilities.

Products

CRM 69 ChurchCRM 7
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.6
    CVE-2026-39338 Public exploit

    ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration

    ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prio…

    ChurchCRM CRM
  • High 8.8
    CVE-2026-24854 Public exploit

    Church CRM has SQL injection in PaddleNumEditor.php

    ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection …

    ChurchCRM CRM
  • High 8.5
    CVE-2025-67875 Public exploit

    ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking

    ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can i…

    ChurchCRM CRM
  • High 8.8
    CVE-2024-39304 Public exploit

    ChurchCRM SQL Injection Vulnerability

    ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessa…

    ChurchCRM CRM