Vulnerabilities in ChurchCRM

76 results
Vexday analysis

Com 72 CVEs catalogadas e 42 delas surgidas nos últimos 90 dias, o ChurchCRM apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção redobrada de equipes de segurança. Nenhuma CVE consta no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, o que indica ausência de exploração ativa confirmada, mas não reduz a preocupação com as 20 falhas de severidade crítica identificadas. O tipo de falha mais comum é CWE-89 (injeção de SQL), padrão que historicamente facilita comprometimento de dados e escalonamento de acesso, e a CVE mais perigosa atualmente é CVE-2025-62521, com escore EPSS de 0,0415. A presença de PoC pública em 2 CVEs eleva o risco de exploração oportunista, tornando a aplicação de correções uma prioridade operacional para ambientes que utilizam essa plataforma.

CVE-2025-66395HIGHSQL Injection in Event List via `WhichType` ParameterEPSS 0.4%CVE-2026-32880MEDIUMChurchCRM is vulnerable to Stored XSS through JSON handling in SystemSettings.phpEPSS 0.4%CVE-2026-40482HIGHChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}`EPSS 0.4%CVE-2025-68111HIGHChurchCRM has SQL Injection in eGive Import FeatureEPSS 0.4%CVE-2025-67877HIGHChurchCRM SQL Injection VulnerabilityEPSS 0.4%CVE-2026-35574HIGHChurchCRM has a Stored XSS in Person Profile - Add a NoteEPSS 0.4%CVE-2026-39336MEDIUMChurchCRM has Stored XSS from unescaped config values in HTML attributesEPSS 0.4%CVE-2026-35576HIGHChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpEPSS 0.4%CVE-2026-24854HIGHChurch CRM has SQL injection in PaddleNumEditor.phpEPSS 0.4%CVE-2026-39940MEDIUMChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.phpEPSS 0.4%CVE-2026-35575HIGHChurchCRM has Stored XSS in Group NameEPSS 0.4%CVE-2026-44547CRITICALChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2EPSS 0.4%CVE-2026-58408MEDIUMChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PIIEPSS 0.4%CVE-2026-35572HIGHSSRF via Referer header in ChurchCRM allows server-side HTTP/HTTPS requests to arbitrary hostsEPSS 0.4%CVE-2026-39332HIGHChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.phpEPSS 0.4%CVE-2026-39333HIGHChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.phpEPSS 0.4%CVE-2026-39328HIGHChurchCRM has Stored XSS in Social Profile FieldsEPSS 0.4%CVE-2025-67874MEDIUMChurchCRM has plaintext password return in responseEPSS 0.4%CVE-2026-39338HIGHChurchCRM has Blind XSS via Global Search – Administrative Cookie Session ExfiltrationEPSS 0.3%CVE-2025-66397HIGHChurchCRM's Kiosk Manager Functions are vulnerable to Broken Access ControlEPSS 0.3%