Vendor

    ChurchCRM

    127 known vulnerabilities in products by ChurchCRM, 0 of them actively exploited (CISA KEV).

    Key figures

    127

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    26

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ChurchCRM
    CriticalCVE-2025-62521

    ChurchCRM has unauthenticated RCE in its Install Wizard

    		10.0
    CriticalCVE-2025-1023

    SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php

    		9.8
    HighCVE-2024-39304

    ChurchCRM SQL Injection Vulnerability

    		8.8
    HighCVE-2022-31325

    ChurchCRM CRM: SQL Injection

    		7.2
    CriticalCVE-2025-68109

    ChurchCRM vulnerable to RCE with database restore functionality

    		9.1
    CriticalCVE-2026-39339

    ChurchCRM has an API Authentication Bypass

    		9.1
    CriticalCVE-2024-25897

    ChurchCRM CRM: SQL Injection

    		9.8
    CriticalCVE-2026-42288

    ChurchCRM CRM: Code Injection

    		10.0
    CriticalCVE-2026-40484

    ChurchCRM CRM: Unrestricted Upload of File with Dangerous Type

    		9.1
    CriticalCVE-2026-39337

    ChurchCRM Affected by Unauthenticated RCE in Install Wizard

    		10.0
    HighCVE-2023-29842

    ChurchCRM CRM: SQL Injection

    		8.8
    CriticalCVE-2026-35573

    ChurchCRM has a Path traversal leads to RCE

    		9.1
    CriticalCVE-2026-58409

    ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload

    		9.1
    HighCVE-2020-28848

    ChurchCRM CRM: Code Execution

    		8.8
    HighCVE-2021-41965

    ChurchCRM CRM: SQL Injection

    		8.8
    CriticalCVE-2025-1135

    SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php

    		7.2
    CriticalCVE-2025-1134

    SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php

    		7.2
    MediumCVE-2023-25346

    ChurchCRM CRM: Cross-Site Scripting (XSS)

    		6.1
    CriticalCVE-2026-40582

    ChurchCRM CRM: Authentication Bypass Using an Alternate Path or Channel

    		—
    CriticalCVE-2025-1133

    SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php

    		7.2
    CriticalCVE-2024-25894

    ChurchCRM CRM: SQL Injection

    		9.8
    CriticalCVE-2025-68110

    ChurchCRM discloses database information on error message

    		10.0
    CriticalCVE-2024-53438

    ChurchCRM CRM: SQL Injection

    		9.8
    CriticalCVE-2025-1132

    SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.php

    		8.8
    MediumCVE-2023-26843

    ChurchCRM CRM: Cross-Site Scripting (XSS)

    		5.4

    All vulnerabilities in search

    Products

    Products by ChurchCRM
    ChurchCRM CRM1100
    ChurchCRM CRM690