Vulnerabilities in ChurchCRM

76 results
Vexday analysis

Com 72 CVEs catalogadas e 42 delas surgidas nos últimos 90 dias, o ChurchCRM apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção redobrada de equipes de segurança. Nenhuma CVE consta no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, o que indica ausência de exploração ativa confirmada, mas não reduz a preocupação com as 20 falhas de severidade crítica identificadas. O tipo de falha mais comum é CWE-89 (injeção de SQL), padrão que historicamente facilita comprometimento de dados e escalonamento de acesso, e a CVE mais perigosa atualmente é CVE-2025-62521, com escore EPSS de 0,0415. A presença de PoC pública em 2 CVEs eleva o risco de exploração oportunista, tornando a aplicação de correções uma prioridade operacional para ambientes que utilizam essa plataforma.

CVE-2025-62521CRITICALChurchCRM has unauthenticated RCE in its Install WizardEPSS 4.5%CVE-2024-39304HIGHChurchCRM SQL Injection VulnerabilityEPSS 3.0%CVE-2025-1023CRITICALSQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.phpEPSS 2.5%CVE-2026-39339CRITICALChurchCRM has an API Authentication BypassEPSS 1.8%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.5%CVE-2026-39337CRITICALChurchCRM Affected by Unauthenticated RCE in Install WizardEPSS 1.1%CVE-2026-42288CRITICALChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORDEPSS 1.0%CVE-2026-40484CRITICALChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore FunctionEPSS 1.0%CVE-2026-35573CRITICALChurchCRM has a Path traversal leads to RCEEPSS 0.9%CVE-2026-58409CRITICALChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin UploadEPSS 0.8%CVE-2025-1135CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.phpEPSS 0.8%CVE-2025-1134CRITICALSQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.phpEPSS 0.8%CVE-2026-40582CRITICALChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account LockoutEPSS 0.7%CVE-2025-1133CRITICALSQL Injection in ChurchCRM EID Parameter via EditEventAttendees.phpEPSS 0.6%CVE-2025-1132CRITICALSQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.phpEPSS 0.6%CVE-2026-39318HIGHChurchCRM has a DDL SQL Injection in GroupPropsFormRowOps.phpEPSS 0.5%CVE-2026-39342CRITICALChurchCRM has a SQL injection searchwhat parameter via QueryView.phpEPSS 0.5%CVE-2026-39325HIGHChurchCRM has a Blind SQL injection in SettingsUser.phpEPSS 0.5%CVE-2026-39343HIGHChurchCRM has a SQL Injection in Event Type Editor (Admin)EPSS 0.4%CVE-2026-58411HIGHChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and valuesEPSS 0.4%