Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
127 results · page 3 of 3
Aug 8, 2023SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QCVE-2023-38764 · Other software · Churchcrm · reported by MITREHigh 7.5
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iodemo.churchcrm.io
Aug 8, 2023SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserECVE-2023-38763 · Other software · Churchcrm · reported by MITREMedium 6.5
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iodemo.churchcrm.io
Aug 8, 2023SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.pCVE-2023-38762 · Other software · Churchcrm · reported by MITREHigh 7.5
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iodemo.churchcrm.io
Aug 8, 2023Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.phpCVE-2023-38761 · Other software · Churchcrm · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iodemo.churchcrm.io
Aug 8, 2023SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryViCVE-2023-38760 · Other software · Churchcrm · reported by MITREHigh 7.5
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iodemo.churchcrm.io
Jun 28, 2023Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parametersCVE-2023-33661 · Other software · Churchcrm · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts orCVE-2023-31548 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.CVE-2023-26842 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.CVE-2023-31699 · Other software · Churchcrm · reported by MITREMedium 4.8
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.CVE-2023-29842 · Other software · Churchcrm · reported by MITREHigh 8.8
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 25, 2023A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.CVE-2023-26843 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently loggeCVE-2023-26841 · Other software · Churchcrm · reported by MITREMedium 6.5
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.CVE-2023-26840 · Other software · Churchcrm · reported by MITREMedium 5.3
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.CVE-2023-26839 · Other software · Churchcrm · reported by MITREMedium 4.3
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person.CVE-2023-25348 · Other software · Churchcrm · reported by MITREHigh 7.8
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields.CVE-2023-25347 · Other software · Churchcrm · reported by MITREMedium 5.4
A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2023A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /CVE-2023-25346 · Other software · Churchcrm · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2023The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack CVE-2023-26855 · Other software · Churchcrm · reported by MITREHigh 7.5
The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2023A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafteCVE-2023-27059 · Other software · Churchcrm · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2023ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.CVE-2023-24690 · Other software · Churchcrm · reported by MITREMedium 5.4
ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iogithub.com
Feb 9, 2023An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.CVE-2023-24686 · Other software · Churchcrm · reported by MITREMedium 4.8
An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iogithub.com
Feb 9, 2023ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.CVE-2023-24685 · Other software · Churchcrm · reported by MITREHigh 7.2
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iopacketstormsecurity.com
Feb 9, 2023ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.CVE-2023-24684 · Other software · Churchcrm · reported by MITREHigh 7.2
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.iogithub.com
Nov 28, 2022ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.CVE-2022-36137 · Other software · Churchcrm · reported by MITREMedium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgrimthereaperteam.medium.com
Nov 28, 2022ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.CVE-2022-36136 · Other software · Churchcrm · reported by MITREMedium 4.8
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgrimthereaperteam.medium.com
Jun 8, 2022There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.CVE-2022-31325 · Other software · Churchcrm · reported by MITREHigh 7.2
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 15, 2022A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the databaseCVE-2021-41965 · Other software · Churchcrm · reported by MITREHigh 8.8
A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being performed.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchurchcrm.ioalexbilz.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.