Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
127 results · page 1 of 3
Jul 13, 2026ChurchCRM is an open-source church management system.CVE-2026-58411 · Other software · ChurchCRM · reported by GitHubHigh 7
ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into JavaScript string contexts and HTML attribute contexts without proper sanitization or contextual output encoding. Affected endpoints observed during testing: /FamilyCustomFieldsEditor.php, /PaddleNumList.php and /admin/system/church-info. Potential consequences include session-token theft, account takeover, unauthorized actions on behalf of authenticated users, exposure of sensitive church member information, credential harvesting, phishing, and privilege escalation when administrators are targeted. This issue has been resolved in version 7.4.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026ChurchCRM is an open-source church management system.CVE-2026-58410 · Other software · ChurchCRM · reported by GitHubHigh 7.1
ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged users to read and modify other families’ records. An authenticated non-admin user with EditSelf access can supply another family’s `familyId` and access records outside their own family scope. The backend trusts the attacker-controlled `familyId` and loads the corresponding family entity by ID without verifying that the requested family belongs to the current user. If the same user also has Notes permission, they can create notes on another family’s record. This breaks the intended EditSelf scope and allows access to unrelated congregation records. This issue has been fixed in version 7.4.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026ChurchCRM is an open-source church management system.CVE-2026-58409 · Other software · ChurchCRM · reported by GitHubCritical 9.1
ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block standard .php files. Because `php` is explicitly included in the allowed extension list for plugin archives, and extracted files are placed directly under the web root, any PHP file inside the ZIP becomes immediately executable via HTTP — without even needing to "enable" the plugin through the application UI. The /plugins/install-url API route (management.php) allows an administrator to source the malicious ZIP from any attacker-controlled HTTPS URL, validating it only against an attacker-supplied SHA-256 hash. This issue has been fixed in version 7.4.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 13, 2026ChurchCRM is an open-source church management system.CVE-2026-58408 · Other software · ChurchCRM · reported by GitHubMedium 6.5
ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse "has any admin permission" gate inherited from the legacy page bootstrap. In other words, any single non-admin permission flag is enough to reach the CSV bulk-export endpoint, even though such users should not have data export rights. The export script is missing a dedicated isAdmin() (or a new bExportData) authorization check of its own. This issue has been fixed in version 7.4.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026ChurchCRM is an open-source church management system.CVE-2026-44548 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026ChurchCRM is an open-source church management system.CVE-2026-44547 · Other software · ChurchCRM · reported by GitHubCritical 9.6
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/public/public-user.php by an unrelated PR before any 7.2.x tag was cut. Every shipped 7.2.x release therefore remains exploitable by the PoC published with the original advisory. This vulnerability is fixed in 7.3.1.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026ChurchCRM is an open-source church management system.CVE-2026-42289 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $_POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently elevates any low-privilege user to full administrator or creates a new admin backdoor account without the victim's knowledge This vulnerability is fixed in 7.3.2.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2026ChurchCRM is an open-source church management system.CVE-2026-42288 · Other software · ChurchCRM · reported by GitHubCritical 10
ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40593 · Other software · ChurchCRM · reported by GitHubMedium 4.8
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) renders stored usernames directly into an HTML input value attribute without applying htmlspecialchars(). An administrator can save a username containing HTML attribute-breaking characters and event handlers, which execute in the browser of any administrator who subsequently views that user's editor page, resulting in stored XSS. This issue has been fixed in version 7.2.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40582 · Other software · ChurchCRM · reported by GitHubCritical 9.1
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint validates only the username and password before returning the user's API key, bypassing the normal authentication flow that enforces account lockout and two-factor authentication checks. An attacker with knowledge of a user's password can obtain API access even when the account is locked or has 2FA enabled, granting direct access to all protected API endpoints with that user's privileges. This issue has been fixed in version 7.2.0. Note: this issue had a duplicate, GHSA-472m-p3gf-46xp, which has been closed.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40581 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, irreversible deletion of family records and all associated data via a plain GET request with no CSRF token validation. An attacker can craft a malicious page that, when visited by an authenticated administrator, silently triggers deletion of targeted family records including associated notes, pledges, persons, and property data without any user interaction. This issue has been fixed in version 7.2.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40485 · Other software · ChurchCRM · reported by GitHubMedium 5.3
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/public/user/login) returns distinguishable HTTP response codes based on whether a username exists: 404 for non-existent users and 401 for valid users with incorrect passwords. An unauthenticated attacker can exploit this difference to enumerate valid usernames, with no rate limiting or account lockout to impede the process. This issue has been fixed in version 7.2.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40484 · Other software · ChurchCRM · reported by GitHubCritical 9.1
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functionality extracts uploaded archive contents and copies files from the Images/ directory into the web-accessible document root using recursiveCopyDirectory(), which performs no file extension filtering. An authenticated administrator can upload a crafted backup archive containing a PHP webshell inside the Images/ directory, which is then written to a publicly accessible path and executable via HTTP requests, resulting in remote code execution as the web server user. The restore endpoint also lacks CSRF token validation, enabling exploitation through cross-site request forgery targeting an authenticated administrator. This issue has been fixed in version 7.2.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40483 · Other software · ChurchCRM · reported by GitHubMedium 5.4
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars(). An authenticated user with Finance permissions can inject HTML attribute-breaking characters and event handlers into the comment field, which are stored in the database and execute in the browser of any user who subsequently opens the pledge record for editing, resulting in stored XSS. This issue has been fixed in version 7.2.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40482 · Other software · ChurchCRM · reported by GitHubHigh 7.1
ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026ChurchCRM is an open-source church management system.CVE-2026-40480 · Other software · ChurchCRM · reported by GitHubHigh 7.1
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person records without performing object-level authorization checks. Although the legacy PersonView.php page enforces canEditPerson() restrictions, the API layer omits this check. Any authenticated user with only EditSelf privileges can enumerate and read other members' records, exposing sensitive PII including names, addresses, phone numbers, and email addresses. This issue has been fixed in version 7.2.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2026ChurchCRM is an open-source church management system.CVE-2026-39940 · Other software · ChurchCRM · reported by GitHubMedium 5.3
ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For this write-up the DonatedItemEditor.php will be used as an example, however wherever all instances of 'linkBack' should be assessed. This vulnerability is fixed in 7.0.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026ChurchCRM is an open-source church management system.CVE-2026-39941 · Other software · ChurchCRM · reported by GitHubMedium 5.3
ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims' browsers. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39344 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, there is a Reflected Cross-Site Scripting (XSS) vulnerability on the login page, which is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers to insert malicious JavaScript scripts. If successful, script can be executed on the client side, potentially stealing sensitive data such as session cookies or replacing the display to show the attacker's login form. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39343 · Other software · ChurchCRM · reported by GitHubHigh 7.2
ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The EN_tyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute arbitrary SQL commands directly against the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39342 · Other software · ChurchCRM · reported by GitHubCritical 9.4
ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports > Query Menu and access to the "Advanced Search" query. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39341 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not used to create the SQL query. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39340 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in PropertyTypeEditor.php, part of the administration functionality for managing property type categories (People → Person Properties / Family Properties). The vulnerability was introduced when legacyFilterInput() which both strips HTML and escapes SQL — was replaced with sanitizeText(), which strips HTML only. User-supplied values from the Name and Description fields are concatenated directly into raw INSERT and UPDATE queries with no SQL escaping. This allows any authenticated user with the MenuOptions role (a non-admin staff permission) to perform time-based blind injection and exfiltrate any data from the database, including password hashes of all users. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39339 · Other software · ChurchCRM · reported by GitHubCritical 9.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability in ChurchCRM's API middleware (ChurchCRM/Slim/Middleware/AuthMiddleware.php) allows unauthenticated attackers to access all protected API endpoints by including "api/public" anywhere in the request URL, leading to complete exposure of church member data and system information. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39338 · Other software · ChurchCRM · reported by GitHubHigh 8.6
ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting vulnerability exists in the search parameter accepted by the ChurchCRM dashboard. The application fails to sanitize or encode user-supplied input prior to rendering it within the browser's DOM. Although the application ultimately returns an HTTP 500 error due to the malformed API request caused by the payload, the browser's JavaScript engine parses and executes the injected <script> tags before the error response is returned — resulting in successful code execution regardless of the server-side error. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39337 · Other software · ChurchCRM · reported by GitHubCritical 10
ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39336 · Other software · ChurchCRM · reported by GitHubMedium 6.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the Directory Reports form fields set from config, Person editor defaults rendered into address fields, and external self-registration form defaults. This is primarily an admin-to-admin stored XSS path where writable configuration fields are abused. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39335 · Other software · ChurchCRM · reported by GitHubMedium 6.1
ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and family editor state/country. This is primarily an admin-to-admin stored XSS path when writable entity fields are abused. This vulnerability is fixed in 7.1.1.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39334 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsIndividual.php in ChurchCRM 7.0.5. Authenticated users without any specific privileges can inject arbitrary SQL statements through the type array parameter via the index and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39333 · Other software · ChurchCRM · reported by GitHubHigh 8.7
ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects user-supplied input (DateStart and DateEnd) into HTML input field attributes without proper output encoding for the HTML attribute context. An authenticated attacker can craft a malicious URL that executes arbitrary JavaScript when visited by another authenticated user. This constitutes a reflected XSS vulnerability. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39332 · Other software · ChurchCRM · reported by GitHubHigh 8.7
ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS) vulnerability in GeoPage.php allows any authenticated user to inject arbitrary JavaScript into the browser of another authenticated user. Because the payload fires automatically via autofocus with no user interaction required, an attacker can steal session cookies and fully take over any victim account, including administrator accounts, by tricking them into submitting a crafted form. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39331 · Other software · ChurchCRM · reported by GitHubHigh 8.1
ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorization by simply changing the {familyId} parameter in requests, regardless of whether they possess the required EditRecords privilege. /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, and /family/{familyId}/geocode lack role-based access control, allowing users to deactivate/reactivate arbitrary families, spam verification emails, and mark families as verified and trigger geocoding. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39330 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyAssign.php in ChurchCRM. Authenticated users with the role Manage Groups & Roles (ManageGroups) and Edit Records (isEditRecordsEnabled) can inject arbitrary SQL statements through the Value parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39329 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39328 · Other software · ChurchCRM · reported by GitHubHigh 8.9
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in ChurchCRM's person profile editing functionality. Non-administrative users who have the EditSelf permission can inject malicious JavaScript into their Facebook, LinkedIn, and X profile fields. Due to a 50-character field limit, the payload is distributed across all three fields and chains their onfocus event handlers to execute in sequence. When any user, including administrators, views the attacker's profile, their session cookies are exfiltrated to a remote server. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39327 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /MemberRoleChange.php in ChurchCRM 7.0.5. Authenticated users with the role Manage Groups & Roles (ManageGroups) can inject arbitrary SQL statements through the NewRole parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39326 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyTypeEditor.php in ChurchCRM. Authenticated users with the role isMenuOptionsEnabled can inject arbitrary SQL statements through the Name and Description parameters and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39325 · Other software · ChurchCRM · reported by GitHubHigh 7.2
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsUser.php in ChurchCRM 7.0.5. Authenticated administrative users can inject arbitrary SQL statements through the type array parameter via the index and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39319 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-39318 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints `/GroupPropsFormRowOps.php`, `/PersonCustomFieldsRowOps.php`, and `/FamilyCustomFieldsRowOps.php`. A user has to be authenticated. For `ManageGroups` privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the `Field` parameter and thus modify tables from the database. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-35576 · Other software · ChurchCRM · reported by GitHubHigh 8.7
ChurchCRM is an open-source church management system. Prior to 7.0.0, a stored cross-site scripting (XSS) vulnerability exists in ChurchCRM within the Person Property Management subsystem. This issue persists in versions patched for CVE-2023-38766 and allows an authenticated user to inject arbitrary JavaScript code via dynamically assigned person properties. The malicious payload is persistently stored and executed when other users view the affected person profile or access the printable view, potentially leading to session hijacking or full account compromise. This vulnerability is fixed in 7.0.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-35575 · Other software · ChurchCRM · reported by GitHubHigh 8
ChurchCRM is an open-source church management system. Prior to 6.5.3, a Stored Cross-Site Scripting (Stored XSS) vulnerability in the admin panel’s group-creation feature allows any user with group-creation privileges to inject malicious JavaScript that executes automatically when an administrator views the page. This enables attackers to steal the administrator’s session cookies, potentially leading to full administrative account takeover. This vulnerability is fixed in 6.5.3.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-35573 · Other software · ChurchCRM · reported by GitHubCritical 9.1
ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's backup restore functionality allows authenticated administrators to upload arbitrary files and achieve remote code execution by overwriting Apache .htaccess configuration files. The vulnerability exists in src/ChurchCRM/Backup/RestoreJob.php. The $rawUploadedFile['name'] parameter is user-controlled and allows uploading files with arbitrary names to /var/www/html/tmp_attach/ChurchCRMBackups/. This vulnerability is fixed in 6.5.3.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-35572 · Other software · ChurchCRM · reported by GitHubHigh 7
ChurchCRM is an open-source church management system. Prior to 6.5.3, it is possible to trigger server-side HTTP/HTTPS requests to arbitrary hosts (SSRF) by supplying a crafted URL in the Referer request header. The server subsequently makes an outbound request to the attacker-controlled domain, confirmed via OAST. This vulnerability is fixed in 6.5.3.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-35574 · Other software · ChurchCRM · reported by GitHubHigh 7.3
ChurchCRM is an open-source church management system. Prior to 6.5.3, a stored Cross-Site Scripting (XSS) vulnerability in ChurchCRM's Note Editor allows authenticated users with note-adding permissions to execute arbitrary JavaScript code in the context of other users' browsers, including administrators. This can lead to session hijacking, privilege escalation, and unauthorized access to sensitive church member data. This vulnerability is fixed in 6.5.3.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026ChurchCRM is an open-source church management system.CVE-2026-35534 · Other software · ChurchCRM · reported by GitHubHigh 7.6
ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability exists in PersonView.php due to incorrect use of sanitizeText() as an output sanitizer for HTML attribute context. The function only strips HTML tags, it does not escape quote characters allowing an attacker to break out of the href attribute and inject arbitrary JavaScript event handlers. Any authenticated user with the EditRecords role can store the payload in a person's Facebook field. The XSS fires against any user who views that person's profile page, including administrators, enabling session hijacking and full account takeover. This vulnerability is fixed in 7.1.0.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 19, 2026ChurchCRM is an open-source church management system.CVE-2026-32880 · Other software · ChurchCRM · reported by GitHubMedium 6.4
ChurchCRM is an open-source church management system. Versions prior to 7.0.2 allow an admin user to edit JSON type system settings to store a JavaScript payload that can execute when any admin views the system settings. The JSON input is left unescaped/unsanitized in SystemSettings.php, leading to XSS. This issue has been fixed in version 7.0.2.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2026ChurchCRM is an open-source church management system.CVE-2026-26059 · Other software · ChurchCRM · reported by GitHubLow 2.1
ChurchCRM is an open-source church management system. In versions prior to 6.8.2, it was possible for an authenticated user with permission to edit groups to store a JavaScript payload that would execute when the group was viewed in the Group View. Version 6.8.2 fixes this issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026ChurchCRM is an open-source church management system.CVE-2026-24855 · Other software · ChurchCRM · reported by GitHubHigh 7.2
ChurchCRM is an open-source church management system. Versions prior to 6.7.2 have a Stored Cross-Site Scripting (XSS) vulnerability occurs in Create Events in Church Calendar. Users with low privileges can create XSS payloads in the Description field. This payload is stored in the database, and when other users view that event (including the admin), the payload is triggered, leading to account takeover. Version 6.7.2 fixes the vulnerability.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 30, 2026ChurchCRM is an open-source church management system.CVE-2026-24854 · Other software · ChurchCRM · reported by GitHubHigh 8.8
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the `PerID` parameter. Version 6.7.2 contains a patch for the issue.
- Product
- CRM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.