CVE-2023-38767

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

CVE-2023-38767

ChurchCRM v5.0.0 is affected by an SQL injection in /QueryView.php, exploitable via the value and custom parameters. Root cause: unsafely constructed SQL queries in that endpoint allow remote disclosure of sensitive information. Exploitation in the wild is not documented in the provided sources; ...

CVE-2023-38767

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

CVE-2023-38765

The vulnerability CVE-2023-38765 is a SQL injection in ChurchCRM v5.0.0, exploitable via the membermonth parameter in /QueryView.php. The root cause is unsafe handling of user input leading to unauthorized access to sensitive data. Impact is limited to information disclosure as described; no expl...

CVE-2023-38767

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php...

CVE-2023-38765

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php...

CVE-2023-38765: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php...

CVE-2023-38769

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php...

CVE-2023-38769

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php...

CVE-2023-38773

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php...

PT-2023-26596

Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.0.0 Description A SQL injection issue allows a remote attacker to obtain sensitive information via the PropertyID parameter within the "/QueryView.php" API endpoint. Recommendations For ChurchCRM version 5.0.0, consider...

CVE-2023-38765

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php...

CVE-2023-38765

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php...

PT-2023-26599

Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.0.0 Description A SQL injection issue allows a remote attacker to obtain sensitive information via the group parameter within the "/QueryView.php" API endpoint. Recommendations For ChurchCRM version 5.0.0, update to a versi...

CVE-2023-38770: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php...

CVE-2023-38768

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php...

CVE-2023-38769: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php...

CVE-2023-38770

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php...

CVE-2023-38769

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php...

CVE-2023-38762: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php...