CVE-2025-67751 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

CVE-2025-67751

ChurchCRM prior to version 6.5.0 contains a SQL injection in EventEditor.php. When creating a new event and selecting an event type, the EN_tyid POST parameter is not sanitized, allowing an authenticated user with event management permissions (isAddEvent) to execute arbitrary SQL queries. The iss...

CVE-2025-67751 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

CVE-2025-67751 ChurchCRM has SQL Injection in Event Editor via `EN_tyid` Parameter caused by an Incomplete Fix

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the EventEditor.php file. When creating a new event and selecting an event type, the ENtyid POST parameter is not sanitized. This allows an authenticated user with event managemen...

PT-2025-51357

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.0 Description A SQL injection issue exists in the EventEditor.php file of ChurchCRM. The EN tyid POST parameter, used when creating a new event and selecting an event type, is not properly sanitized. This allows...

ChurchCRM SQL注入漏洞

ChurchCRM is ChurchCRM open source an open source CRM system for churches. A SQL injection vulnerability exists in ChurchCRM versions prior to 6.5.0, which stems from a SQL injection issue in the EventEditor.php file, which could lead to the execution of arbitrary SQL queries...

CVE-2025-67634

The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would...

CVE-2025-13610

creationtimestamp| type| source ---|---|--- 2025-12-15 15:18:40+00:00| seen| https://gist.github.com/Darkcrai86/83f7679f8e122bedb4063420aa9509c9...

How-to Restore Lost Access to Cache Database After Using Custom SSL Certificate

Article Applicability This article is relevant only if the Veeam ONE deployment uses a custom SSL certificate, and not the one generated by the Veeam ONE installer. The error shown in the challenge section can also occur if the Veeam ONE Caching Service cannot access the PostgreSQL instance that...

CVE-2025-40263

In the Linux kernel, the following vulnerability has been resolved: Input: croseckeyb - fix an invalid memory access If croseckeybregistermatrix isn't called due to buttonsswitchesonly in croseckeybprobe, ckdev-idev remains NULL. An invalid memory access is observed in croseckeybprocess when...

CVE-2025-10289

creationtimestamp| type| source ---|---|--- 2025-12-13 11:46:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7ujr5ne2v2y 2025-12-15 08:54:11+00:00| seen| https://gist.github.com/Darkcrai86/68ddee95ed9e3d4d1c23c3ab05b9c556...

CVE-2025-36752

creationtimestamp| type| source ---|---|--- 2025-12-13 11:28:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7uiptuzgj2c 2025-12-14 00:04:03+00:00| seen| https://infosec.exchange/users/offseq/statuses/115714991181828880...

CVE-2025-13904

The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including, 1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-46276

creationtimestamp| type| source ---|---|--- 2025-12-12 23:42:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7tbbjydkl2e 2025-12-16 06:48:31+00:00| seen| https://vulnerability.circl.lu/bundle/c5b7cfe4-31dc-48ad-9aad-8e8bd3c6bf83...

CVE-2025-43518

creationtimestamp| type| source ---|---|--- 2025-12-12 23:10:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7t7jd5qgs2y 2025-12-16 06:48:31+00:00| seen| https://vulnerability.circl.lu/bundle/c5b7cfe4-31dc-48ad-9aad-8e8bd3c6bf83...

CVE-2025-14565

creationtimestamp| type| source ---|---|--- 2025-12-12 20:09:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7svflvolj22...

CVE-2025-12408 Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'getlocation' action due to insufficient restrictions on which locations can be included. This makes it possible for...

CVE-2025-14143

creationtimestamp| type| source ---|---|--- 2025-12-12 08:31:35+00:00| seen| https://gist.github.com/Darkcrai86/b523ad6047c211eb2d261ab656b89f38...

CVE-2025-14068

creationtimestamp| type| source ---|---|--- 2025-12-12 07:15:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7rk62ladp2c 2025-12-12 08:11:21+00:00| seen| https://gist.github.com/Darkcrai86/387740b3506022e31e89d3396a55e559 2025-12-12 09:39:36+00:00| seen|...

EUVD-2025-202998

The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including, 1.12 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...