CVE-2025-68110

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue...

CVE-2025-68111

ChurchCRM is affected by a SQL injection in the eGive.php file (ReImport) for versions prior to 6.5.3. An authenticated user with finance privileges can manipulate the MissingEgive_FamID_... POST parameter to execute arbitrary SQL, leading to unauthorized data access, modification, or deletion wi...

EUVD-2025-203991

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the src/CartToFamily.php file, specifically in how the PersonAddress POST parameter is handled. Unlike other parameters in the same file which are correctly cast to integers using t...

CVE-2025-66396

ChurchCRM exposes a SQL injection in src/UserEditor.php affecting versions prior to 6.5.3. The vulnerability arises when an administrator saves user configuration settings: the code iterates over the POST type parameter array, uses the array key (expected numeric id) directly in SELECT/UPDATE que...

ChurchCRM SQL注入漏洞

ChurchCRM is an open source church management system. ChurchCRM suffers from a SQL injection vulnerability that originates from the unvalidated familyId parameter in legacy endpoints/Reports/ConfirmReportEmail.php, and no details of the vulnerability are provided at this time...

ChurchCRM 安全漏洞

ChurchCRM is an open source church management system. ChurchCRM suffers from an information disclosure vulnerability that originates from the disclosure of database information in an error message, which can be exploited by an attacker to cause the disclosure of database information, including...

CVE-2023-47675

CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command...

PT-2023-9370 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.5.3 Description: The issue is related to a use-after-free bug in the Linux kernel. This bug occurs because the original code puts flush work before timer shutdown sync in switch drv remove, allowing the worker...