ChurchCRM vulnerabilities
We track 71 vulnerabilities in ChurchCRM products across 2 products. 71 are rated high or critical, and none are known to be exploited. The most recent was published on July 13, 2026.
Latest ChurchCRM vulnerabilities
- 8.8 High severity
CRM: Generation of Error Message Containing Sensitive Information
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.
- 7.2 High severity
CRM: Improper Neutralization of Special Elements used in an OS Command
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload
- 8.8 High severity
CRM: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifically in how the `PersonAddress` POST parameter is handled. Unlike other parameters in the same file whi
- 8.3 High severity
CRM: Improper Access Control
ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions in the Kiosk Manager feature suffers from broken access control, allowing any authenticated user to allow
- 7.2 High severity
CRM: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/UserEditor.php` file. When an administrator saves a user's configuration settings, the keys of the `type` POST parameter array are no
- 8.8 High severity
CRM: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/ListEvents.php` file. When filtering events by type, the `WhichType` POST parameter is not properly sanitized or type-casted before b
- 9.8 Critical severity
CRM: Improper Control of Generation of Code
ChurchCRM is an open-source church management system. Prior to version 5.21.0, a pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation pr
- 7.2 High severity
CRM: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not sanitized. This allows
- 7.2 High severity
CRM: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorpor
- 7.2 High severity
ChurchCRM: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was determined in ChurchCRM up to 5.18.0. This issue affects some unknown processing of the file src/ChurchCRM/Backup/RestoreJob.php of the component Backup Restore Handler. Executing a manipulation of the argument restoreFile can lead to path
- 8.1 High severity
ChurchCRM: Deserialization of Untrusted Data
A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may be initiated remotel
- 9.8 Critical severity
ChurchCRM: Improper Authentication
A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php of the component API Endpoint. The manipulation results in missing authentication. The attack c
- 7.2 High severity
ChurchCRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the BatchWinnerEntry functionality. The CurrentFundraiser parameter
- 7.2 High severity
ChurchCRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the DonatedItemEditor functionality. The CurrentFundraiser parameter
- 7.2 High severity
ChurchCRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees functionality. The EID parameter is directly concatenated in
- 8.8 High severity
ChurchCRM: Improper Neutralization of Special Elements used in an SQL Command
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is directly inserted into an SQL query without proper sanitization, allowing attackers to inject maliciou
- 9.8 Critical severity
ChurchCRM: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes functionality. The newCountName parameter is directly concatenated
- 9.8 Critical severity
churchcrm: Improper Neutralization of Special Elements used in an SQL Command
EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attac
- 8.8 High severity
CRM: Improper Neutralization of Special Elements used in an SQL Command
ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessar
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php.
- 7.5 High severity
Churchcrm: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component.
- 7.8 High severity
Churchcrm: Improper Neutralization of Formula Elements in a CSV File
ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file.
- 7.5 High severity
Churchcrm: Use of Insufficiently Random Values
The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.