PT-2025-7492

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 5.13.0 and prior Description A time-based blind SQL Injection vulnerability exists in the EditEventAttendees.php file within the EN tyid parameter. The parameter is directly inserted into an SQL query without proper...

PT-2022-11518

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 2.0.0 through 4.4.5 Description A SQL injection issue exists that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN tyid, theID, and EID fields used when an Edit...