Churchcrm
by Churchcrm
Source repositories
CVEs (118)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-38771 | 0.00 | — | 0.01 | Aug 8, 2023 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php. | |||
| CVE-2023-38766 | 0.00 | — | 0.01 | Aug 8, 2023 | Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component. | |||
| CVE-2023-33661 | 0.00 | — | 0.01 | Jun 28, 2023 | Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. | |||
| CVE-2023-29842 | 0.00 | — | 0.01 | May 4, 2023 | ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter. | |||
| CVE-2023-26840 | 0.00 | — | 0.00 | Apr 25, 2023 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. | |||
| CVE-2023-26839 | 0.00 | — | 0.00 | Apr 25, 2023 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. | |||
| CVE-2023-25348 | 0.00 | — | 0.00 | Apr 25, 2023 | ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. | |||
| CVE-2023-25347 | 0.00 | — | 0.01 | Apr 25, 2023 | A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php. | |||
| CVE-2023-26841 | 0.00 | — | 0.00 | Apr 25, 2023 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in. | |||
| CVE-2023-26855 | 0.00 | — | 0.01 | Apr 4, 2023 | The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords. | |||
| CVE-2023-27059 | 0.00 | — | 0.00 | Mar 16, 2023 | A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field. | |||
| CVE-2023-24690 | 0.00 | — | 0.00 | Feb 9, 2023 | ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family. | |||
| CVE-2023-24685 | 0.00 | — | 0.01 | Feb 9, 2023 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module. | |||
| CVE-2023-24684 | 0.00 | — | 0.01 | Feb 9, 2023 | ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php. | |||
| CVE-2023-24686 | 0.00 | — | 0.01 | Feb 9, 2023 | An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file. | |||
| CVE-2022-36136 | 0.00 | — | 0.00 | Nov 29, 2022 | ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment. | |||
| CVE-2022-36137 | 0.00 | — | 0.00 | Nov 29, 2022 | ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader. | |||
| CVE-2021-41965 | 0.00 | — | 0.01 | May 15, 2022 | A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being… |
- CVE-2023-38771Aug 8, 2023risk 0.00cvss —epss 0.01
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php.
- CVE-2023-38766Aug 8, 2023risk 0.00cvss —epss 0.01
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.
- CVE-2023-33661Jun 28, 2023risk 0.00cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
- CVE-2023-29842May 4, 2023risk 0.00cvss —epss 0.01
ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter.
- CVE-2023-26840Apr 25, 2023risk 0.00cvss —epss 0.00
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator.
- CVE-2023-26839Apr 25, 2023risk 0.00cvss —epss 0.00
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.
- CVE-2023-25348Apr 25, 2023risk 0.00cvss —epss 0.00
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
- CVE-2023-25347Apr 25, 2023risk 0.00cvss —epss 0.01
A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php.
- CVE-2023-26841Apr 25, 2023risk 0.00cvss —epss 0.00
A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in.
- CVE-2023-26855Apr 4, 2023risk 0.00cvss —epss 0.01
The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.
- CVE-2023-27059Mar 16, 2023risk 0.00cvss —epss 0.00
A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field.
- CVE-2023-24690Feb 9, 2023risk 0.00cvss —epss 0.00
ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.
- CVE-2023-24685Feb 9, 2023risk 0.00cvss —epss 0.01
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.
- CVE-2023-24684Feb 9, 2023risk 0.00cvss —epss 0.01
ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.
- CVE-2023-24686Feb 9, 2023risk 0.00cvss —epss 0.01
An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file.
- CVE-2022-36136Nov 29, 2022risk 0.00cvss —epss 0.00
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
- CVE-2022-36137Nov 29, 2022risk 0.00cvss —epss 0.00
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
- CVE-2021-41965May 15, 2022risk 0.00cvss —epss 0.01
A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being…
Page 6 of 6