Vulnerabilidades en ChurchCRM

76 resultados
Análisis Vexday

Com 72 CVEs catalogadas e 42 delas surgidas nos últimos 90 dias, o ChurchCRM apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção redobrada de equipes de segurança. Nenhuma CVE consta no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, o que indica ausência de exploração ativa confirmada, mas não reduz a preocupação com as 20 falhas de severidade crítica identificadas. O tipo de falha mais comum é CWE-89 (injeção de SQL), padrão que historicamente facilita comprometimento de dados e escalonamento de acesso, e a CVE mais perigosa atualmente é CVE-2025-62521, com escore EPSS de 0,0415. A presença de PoC pública em 2 CVEs eleva o risco de exploração oportunista, tornando a aplicação de correções uma prioridade operacional para ambientes que utilizam essa plataforma.

CVE-2026-35576HIGHChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.phpEPSS 0.3%CVE-2026-39344HIGHReflected XSS the login page through the 'username' parameterEPSS 0.3%CVE-2026-39325HIGHChurchCRM has a Blind SQL injection in SettingsUser.phpEPSS 0.3%CVE-2026-39343HIGHChurchCRM has a SQL Injection in Event Type Editor (Admin)EPSS 0.3%CVE-2026-39334HIGHChurchCRM has a Blind SQL injection in SettingsIndividual.phpEPSS 0.3%CVE-2026-39335MEDIUMChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family ControlsEPSS 0.3%CVE-2026-39326HIGHChurchCRM has a Blind SQL injection in PropertyTypeEditor.phpEPSS 0.2%CVE-2026-39330HIGHChurchCRM has a Blind SQL injection in PropertyAssign.phpEPSS 0.2%CVE-2026-39329HIGHChurchCRM has a Blind SQL injection in EventNames.phpEPSS 0.2%CVE-2026-39327HIGHChurchCRM has a SQL injection in MemberRoleChange.phpEPSS 0.2%CVE-2026-39319HIGHChurchCRM has a Second Order SQLI via FundRaiserEditor.phpEPSS 0.2%CVE-2026-35575HIGHChurchCRM has Stored XSS in Group NameEPSS 0.2%CVE-2026-39340HIGHChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer SubstitutionEPSS 0.2%CVE-2026-39338HIGHChurchCRM has Blind XSS via Global Search – Administrative Cookie Session ExfiltrationEPSS 0.2%CVE-2026-40483MEDIUMChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment FieldEPSS 0.2%CVE-2026-58408MEDIUMChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PIIEPSS 0.2%CVE-2026-39333HIGHChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.phpEPSS 0.2%CVE-2026-39331HIGHChurchCRM has an API Authorization Bypass Allows Authenticated User to Deactivate, Modify, and Spam Arbitrary FamiliesEPSS 0.2%CVE-2025-0981HIGHSession Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description FieldEPSS 0.2%CVE-2026-44547CRITICALChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2EPSS 0.2%