28 matches found
CVE-2023-25347
A stored cross-site scripting XSS vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php...
CVE-2025-67751 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix
ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...
CVE-2025-67751
ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the "EventEditor.php" file. When creating a new event and selecting an event type, the "ENtyid" POST parameter is not sanitized. This allows an authenticated user with event...
CVE-2025-67751: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...
CVE-2024-25896
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EID POST parameter...
CVE-2024-25894
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...
Sql injection
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EID POST parameter...
Sql injection
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...
CVE-2024-25898
A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php...
CVE-2024-25896
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EID POST parameter...
CVE-2024-25894
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...
CVE-2024-25894
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EventCount POST parameter...
PT-2024-21191
Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.5.0 Description A XSS issue was found in the functionality to edit events, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php. This allows for the potential execution of malicious...
CVE-2024-25896: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EID POST parameter...
PT-2024-21187
Name of the Vulnerable Software and Affected Versions ChurchCRM version 5.5.0 Description The issue concerns a Blind SQL Injection vulnerability, specifically time-based, that can be exploited via the EventCount POST parameter in the /EventEditor.php endpoint. This allows for potential unauthoriz...
CVE-2024-25896
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection Time-based via the EID POST parameter...
CVE-2024-25898
CVE-2024-25898 describes a cross-site scripting vulnerability in ChurchCRM v5.5.0, specifically when editing an event in EventEditor.php where attacker-supplied input in the Event Sermon field can inject malicious JavaScript or HTML. The affected component is ChurchCRM’s EventEditor.php; root cau...
CVE-2024-25894
ChurchCRM version 5.5.0 is vulnerable to a Blind SQL Injection (Time-based) flaw located in the /EventEditor.php page. The vulnerability is triggered via the EventCount POST parameter , allowing an attacker to execute arbitrary SQL commands. Exploitation details and specific remediation steps are...
CVE-2024-25896
ChurchCRM version 5.5.0 is vulnerable to a Time-based Blind SQL Injection vulnerability located in the EventEditor.php file. The root cause is the improper neutralization of special elements used in an SQL command via the EID POST parameter. This flaw can be exploited to gain unauthorized access ...
