18 matches found
CVE-2026-40480: Authorization Bypass Through User-Controlled Key
ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/personId endpoint loads and returns person records without performing object-level authorization checks. Although the legacy PersonView.php page enforces canEditPerson restrictions, the API layer...
EUVD-2005-2475
Malware in sbrugna...
EUVD-2005-2474
Malware in sbrugna...
EUVD-2022-52867
Malicious code in bioql PyPI...
CVE-2022-31325
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php...
ChurchCRM 4.4.5 - SQL injection Vulnerability
Exploit Title: ChurchCRM 4.4.5 - SQLi Exploit Author: nu11secur1ty Vendor: https://churchcrm.io/ Software: https://github.com/ChurchCRM/CRM Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-31325 Description: There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via...
ChurchCRM 4.4.5 - SQLi
Exploit Title: ChurchCRM 4.4.5 - SQLi Exploit Author: nu11secur1ty Date: 05.11.2022 Vendor: https://churchcrm.io/ Software: https://github.com/ChurchCRM/CRM Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-31325 Description: There is a SQL Injection vulnerability in...
ChurchCRM SQL Injection Vulnerability
ChurchCRM, a CRM system for churches, has a SQL injection vulnerability in ChurchCRM version 4.4.5, which originates from a security issue in the "PersonID" field of /churchcrm/WhyCameEditor.php. An attacker could use this vulnerability to perform sql injection and steal data...
CVE-2022-31325
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php...
CVE-2022-31325
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php...
CVE-2022-31325
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php...
CVE-2022-31325
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php...
CVE-2022-31325
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php...
CVE-2022-31325: Improper Neutralization of Special Elements used in an SQL Command
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php...
ChurchCRM SQL注入漏洞
ChurchCRM, a CRM system for churches, has a SQL injection vulnerability in ChurchCRM version 4.4.5, which originates from a security issue in the "PersonID" field of /churchcrm/WhyCameEditor.php. An attacker could use this vulnerability to perform sql injection and steal data...
CVE-2005-2474: Undefined Security Weakness
ChurchInfo allows remote attackers to execute obtain sensitive information via the PersonID parameter to 1 PersonView.php, 2 MemberRoleChange.php, 3 PropertyAssign.php, 4 WhyCameEditor.php, 5 GroupPropsEditor.php, 6 Reports/PDFLabel.php, or 7 UserDelete.php, an invalid Number parameter to 8...
CVE-2005-2473: Undefined Security Weakness
Multiple SQL injection vulnerabilities in ChurchInfo allow remote attackers to execute arbitrary SQL commands via the PersonID parameter to 1 PersonView.php, 2 MemberRoleChange.php, 3 PropertyAssign.php, 4 WhyCameEditor.php, 5 GroupPropsEditor.php, 6 Reports/PDFLabel.php, or 7 UserDelete.php, 8...