ChurchCRM vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 202525
3. 202650

Newest CVEs

• CVE-2026-58411

  ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values

  ChurchCRM · CRM

  High7.0
• CVE-2026-58410

  ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records

  ChurchCRM · CRM

  High7.1
• CVE-2026-58409

  ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

  ChurchCRM · CRM

  Critical9.1
• CVE-2026-58408

  ChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII

  ChurchCRM · CRM

  Medium6.5
• CVE-2026-44548

  ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)

  ChurchCRM · CRM

  High8.1
• CVE-2026-44547

  ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

  ChurchCRM · CRM

  Critical9.6
• CVE-2026-42288

  ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD

  ChurchCRM · CRM

  Critical10.0
• CVE-2026-42289

  ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation

  ChurchCRM · CRM

  High8.8
• CVE-2026-40593

  ChurchCRM: Stored XSS in UserEditor.php via Login Name Field

  ChurchCRM · CRM

  Medium4.8
• CVE-2026-40581

  ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion

  ChurchCRM · CRM

  High8.1