EUVD-2026-23595

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation comment values directly into HTML input value attributes without escaping via htmlspecialchars. An authenticated user with Finance permissions can inject HTML attribute-breaking...

CVE-2026-39940

ChurchCRM is an open-source church management system. Prior to 7.0.0, it was possible in many places across the ChurchCRM application to create a link that, when visited by an authenticated user, would redirect them to any URL chosen by an attacker if they clicked 'Cancel' button on the page. For...

EUVD-2026-20948

ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied input sent via a the EName and EDesc parameters in EditEventAttendees.php to be rendered in a page without proper output encoding, enabling arbitrary JavaScript execution in victims...

CVE-2026-39331

ChurchCRM prior to 7.1.0 has an API authorization bypass: an authenticated API user can modify any family’s state by altering the {familyId} in requests to /family/{familyId}/verify, /family/{familyId}/verify/url, /family/{familyId}/verify/now, /family/{familyId}/activate/{status}, and /family/{f...

CVE-2026-39329 ChurchCRM has a Blind SQL injection in EventNames.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reach...

编号撤回

ChurchCRM is an open-source CRM system developed for churches. This CVE number has been withdrawn...

EUVD-2023-37817

Malicious code in bioql PyPI...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2023-33661

Multiple cross-site scripting XSS vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters...

CVE-2023-24690

ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting XSS vulnerability at /api/public/register/family...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

PT-2024-27105

Name of the Vulnerable Software and Affected Versions Church CRM version 5.8.0 Description A stored cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2024-36647

Church CRM v5.8.0 is affected by a stored cross-site scripting (XSS) vulnerability. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload into the Family Name parameter on the Register a New Family page. To remediate this, users should update to a version where the ...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2024-36647

A stored cross-site scripting XSS vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page...

CVE-2023-33661

Multiple cross-site scripting XSS vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters...

CVE-2023-33661

Multiple cross-site scripting XSS vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters...

CVE-2023-33661

ChurchCRM v4.5.3 is affected by multiple XSS vulnerabilities in GroupReports.php via the GroupRole, ReportModel, and OnlyCart parameters. The CVE description and connected records (CNVD-2023-64493, RH: CVE-2023-33661, NVD, OSV, CNNVD) confirm the presence of cross-site scripting that can be trigg...

CVE-2023-33661

Multiple cross-site scripting XSS vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters...