Product by ChurchCRM
ChurchCRM CRM
69 known vulnerabilities in ChurchCRM CRM (ChurchCRM), 0 of them actively exploited (CISA KEV).
Key figures
69
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
16
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2025-62521 | ChurchCRM has unauthenticated RCE in its Install Wizard | 10.0 | |
| High | CVE-2024-39304 | ChurchCRM SQL Injection Vulnerability | 8.8 | |
| Critical | CVE-2025-68109 | ChurchCRM vulnerable to RCE with database restore functionality | 9.1 | |
| Critical | CVE-2026-39339 | ChurchCRM has an API Authentication Bypass | 9.1 | |
| Critical | CVE-2026-42288 | ChurchCRM CRM: Code Injection | 10.0 | |
| Critical | CVE-2026-40484 | ChurchCRM CRM: Unrestricted Upload of File with Dangerous Type | 9.1 | |
| Critical | CVE-2026-39337 | ChurchCRM Affected by Unauthenticated RCE in Install Wizard | 10.0 | |
| Critical | CVE-2026-35573 | ChurchCRM has a Path traversal leads to RCE | 9.1 | |
| Critical | CVE-2026-58409 | ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload | 9.1 | |
| Critical | CVE-2026-40582 | ChurchCRM CRM: Authentication Bypass Using an Alternate Path or Channel | — | |
| Critical | CVE-2025-68110 | ChurchCRM discloses database information on error message | 10.0 | |
| Critical | CVE-2025-68112 | ChurchCRM has SQL injection in EditEventAttendees.php | 9.6 | |
| Critical | CVE-2026-44547 | ChurchCRM CRM: Missing Critical Step in Authentication | 9.6 | |
| High | CVE-2026-24854 | Church CRM has SQL injection in PaddleNumEditor.php | 8.8 | |
| Critical | CVE-2025-68400 | ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php | 8.8 | |
| Critical | CVE-2026-39342 | ChurchCRM has a SQL injection searchwhat parameter via QueryView.php | 8.8 | |
| High | CVE-2026-58411 | ChurchCRM CRM: Cross-site Scripting | — | |
| High | CVE-2026-39318 | ChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.php | 8.8 | |
| High | CVE-2025-66395 | SQL Injection in Event List via `WhichType` Parameter | 8.8 | |
| High | CVE-2025-67877 | ChurchCRM SQL Injection Vulnerability | 8.8 | |
| High | CVE-2026-35574 | ChurchCRM has a Stored XSS in Person Profile - Add a Note | 8.7 | |
| High | CVE-2026-39334 | ChurchCRM has a Blind SQL injection in SettingsIndividual.php | 8.8 | |
| High | CVE-2026-35576 | ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php | 8.7 | |
| High | CVE-2026-39330 | ChurchCRM has a Blind SQL injection in PropertyAssign.php | 8.8 | |
| High | CVE-2026-39329 | ChurchCRM has a Blind SQL injection in EventNames.php | 8.8 |