CVE-2026-24854-ChurchCRM-6.7.2-Authenticated-Numeric-SQL-Injection

CVE-2026-24854 – ChurchCRM Authenticated Numeric SQL Injection Logic Manipulation PoC Author: Mohammed Idrees Banyamer Country: Jordan Handle: @banyamersecurity GitHub: https://github.com/mbanyamer Overview This repository contains a Proof of Concept PoC demonstrating an authenticated numeric SQL...

ChurchCRM - SQL Injection

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

ChurchCRM v4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-31548 info: name: ChurchCRM v4.5.3 - Cross-Site Scripting author: Harsh severity: medium...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. id: CVE-2023-26842 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site...

ChurchCRM 4.5.3 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. id: CVE-2023-25346 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium...

ChurchCRM - API Authentication Bypass via URL Injection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public id: CVE-2026-39339 info: name:...

CVE-2024-39304

Description This script is a PoC for CVE-2024-39304, where a SQLi is possible due to a lack of sanitization in the ChurchCRM project. Usage python3 CVE-2024-39304.py -u -p -b -v Example: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v Links...

CVE-2025-67876

CVE-2025-67876: ChurchCRM has Stored XSS in Group Role Name Leading to Admin Session Hijacking Overview Field| Details ---|--- CVE ID| CVE-2025-67876 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A stored cross-site scriptin...

CVE-2025-68400

CVE-2025-68400: ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php Overview Field| Details ---|--- CVE ID| CVE-2025-68400 Severity| CRITICAL Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A critical SQL Injection...

CVE-2025-67875

CVE-2025-67875: ChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session Hijacking Overview Field| Details ---|--- CVE ID| CVE-2025-67875 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products ChurchCRM/CRM Details Summary A critical privilege...

CVE-2024-39306

Description This script is a PoC for CVE-2024-39306, where a RCE is possible due to a SQLi where an authenticated user can execute arbitrary commands on a server running ChurchCRM -p -b -c Example: python3 CVE-2024-39306.py -u FirstLast -p Password123 -b http://localhost/churchcrm -c whoami Links...

ChurchCRM API Authentication Bypass (CVE-2026-39339)

Exploits CVE-2026-39339 in ChurchCRM 7.1.0: URL injection with ?bypass=/api/public on protected API routes bypasses AuthMiddleware and returns sensitive person/family records without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM API auth bypass via URL injection...

ChurchCRM Panel - Detect

ChurchCRM panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ChurchCRM Panel - Detect', 'description': 'ChurchCRM panel...

ChurchCRM - Setup Exposure Detection

ChurchCRM setup is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM setup is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ChurchCRM - Setup Exposure Detection', 'description': 'ChurchCRM...

ChurchCRM - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter in /session/begin. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter .""" from...

ChurchCRM - API Authentication Bypass via URL Injection Detection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public !/usr/bin/env python3 -- coding...

CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411

ChurchCRM (open-source church management system) Vulnerability: Prior to version 7.4.0, a Reflected XSS was identified due to insufficient output encoding of user-controlled request parameter names and values. The application reflects attacker-controlled input into JavaScript string contexts and ...