CVE-2024-39304

説明 このスクリプトはCVE-2024-39304のPoCです。ChurchCRMプロジェクトにおけるサニタイズ不足によりSQLiが可能となる脆弱性です。 使い方 python3 CVE-2024-39304.py -u -p -b -v 例: python3 CVE-2024-39304.py -u FirstLast -p Password123 -b http://localhost/churchcrm -v リンク https://github.com/ChurchCRM/CRM/security/advisories/GHSA-2rh6-gr3h-83j9...

CVE-2024-39306

説明 このスクリプトはCVE-2024-39306のPoCです。SQLiによりRCEが可能となり、認証されたユーザーがChurchCRM -p -b -c 例: python3 CVE-2024-39306.py -u FirstLast -p Password123 -b http://localhost/churchcrm -c whoami リンク https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r2gf-5m64-8v39 https://vulners.com/cve/CVE-2024-39306...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. id: CVE-2023-26842 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site...

ChurchCRM - API Authentication Bypass via URL Injection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public id: CVE-2026-39339 info: name:...

ChurchCRM v4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-31548 info: name: ChurchCRM v4.5.3 - Cross-Site Scripting author: Harsh severity: medium...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

ChurchCRM - SQL Injection

A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated into an SQL query without proper...

ChurchCRM 4.5.3 - Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. id: CVE-2023-25346 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium...

CVE-2026-24854-ChurchCRM-6.7.2-Authenticated-Numeric-SQL-Injection

CVE-2026-24854 – ChurchCRM 认证数字型 SQL 注入（逻辑操纵）PoC 作者：Mohammed Idrees Banyamer 国家：约旦 代号：@banyamersecurity GitHub：https://github.com/mbanyamer 概述 本仓库包含一个概念验证（PoC），演示了 ChurchCRM 6.7.2 之前版本中存在的认证数字型 SQL 注入漏洞 。 该漏洞允许通过向本应为数字型的参数注入非数字载荷，实现对 SQL 查询的逻辑操纵 ，从而未经授权地修改查询行为（例如，绕过 WHERE 子句）。 CVE ID：CVE-2026-248...

CVE-2025-67876

CVE-2025-67876: ChurchCRMのグループ役割名における保存型XSSにより管理者セッションがハイジャックされる 概要 フィールド| 詳細 ---|--- CVE ID| CVE-2025-67876 深刻度| CRITICAL アドバイザリ| アドバイザリを表示 発見者| Lukasz Rybak 影響を受ける製品 ChurchCRM/CRM 詳細 要約 ChurchCRMには、「グループの管理Manage...

CVE-2025-68400

CVE-2025-68400: ChurchCRM の ConfirmReportEmail.php における時間ベースのブラインド SQL インジェクション 概要 フィールド| 詳細 ---|--- CVE ID| CVE-2025-68400 深刻度| 緊急 アドバイザリ| アドバイザリを表示 発見者| Lukasz Rybak 影響を受ける製品 ChurchCRM/CRM 詳細 要約 ChurchCRM 6.3.0 のレガシーエンドポイント /Reports/ConfirmReportEmail.php に、重大な SQL インジェクションの脆弱性が存在します。この機能は UI...

CVE-2025-67875

CVE-2025-67875: ChurchCRMにおける人物プロパティ割り当てを介した保存型XSSと管理者セッションハイジャック 概要 項目| 詳細 ---|--- CVE ID| CVE-2025-67875 深刻度| HIGH アドバイザリ| アドバイザリを表示 発見者| Lukasz Rybak 影響を受ける製品 ChurchCRM/CRM 詳細 概要 ChurchCRM バージョン 6.3.0 以前には、重大な特権昇格の脆弱性が存在します。特定の中間レベルの権限（「Edit Records（レコードの編集）」と「Manage Properties and...

CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

EUVD-2026-43557

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411

ChurchCRM (open-source church management system) Vulnerability: Prior to version 7.4.0, a Reflected XSS was identified due to insufficient output encoding of user-controlled request parameter names and values. The application reflects attacker-controlled input into JavaScript string contexts and ...

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58411 ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting XSS vulnerabilities were identified due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into...

CVE-2026-58410

CVE-2026-58410 (ChurchCRM) — Prior to version 7.4.0, an improper object-level authorization flaw in family-scoped endpoints allowed authenticated, non-admin users with EditSelf access to read/modify records from other families by supplying a different familyId. The backend trusts attacker-control...