Vulnerabilidades en ChurchCRM

76 resultados
Análisis Vexday

Com 72 CVEs catalogadas e 42 delas surgidas nos últimos 90 dias, o ChurchCRM apresenta um ritmo recente de descoberta de vulnerabilidades que merece atenção redobrada de equipes de segurança. Nenhuma CVE consta no catálogo KEV da CISA — taxa abaixo da média geral do catálogo —, o que indica ausência de exploração ativa confirmada, mas não reduz a preocupação com as 20 falhas de severidade crítica identificadas. O tipo de falha mais comum é CWE-89 (injeção de SQL), padrão que historicamente facilita comprometimento de dados e escalonamento de acesso, e a CVE mais perigosa atualmente é CVE-2025-62521, com escore EPSS de 0,0415. A presença de PoC pública em 2 CVEs eleva o risco de exploração oportunista, tornando a aplicação de correções uma prioridade operacional para ambientes que utilizam essa plataforma.

CVE-2026-24855HIGHChurchCRM has Stored Cross-Site Scripting (XSS) in Create Events in Church Calendar, Leading to Account TakeoverEPSS 0.2%CVE-2026-39336MEDIUMChurchCRM has Stored XSS from unescaped config values in HTML attributesEPSS 0.2%CVE-2026-39332HIGHChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.phpEPSS 0.2%CVE-2026-39328HIGHChurchCRM has Stored XSS in Social Profile FieldsEPSS 0.2%CVE-2026-40593MEDIUMChurchCRM: Stored XSS in UserEditor.php via Login Name FieldEPSS 0.2%CVE-2026-40581HIGHChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data DeletionEPSS 0.2%CVE-2026-26059LOWChurchCRM has Stored Cross-Site Scripting (XSS) in GroupEditor.phpEPSS 0.2%CVE-2025-68275CRITICALChurchCRM vulnerable to Stored XSS - Group name > Person ListingEPSS 0.2%CVE-2025-68401MEDIUMChurchCRM has Stored Cross-Site Scripting (XSS) vulnerability that leads to session theft and account takeoverEPSS 0.2%CVE-2026-58410HIGHChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ recordsEPSS 0.2%CVE-2025-67876CRITICALChurchCRM has Stored XSS in Group Role Name Leading to Admin Session HijackingEPSS 0.2%CVE-2025-68399LOWChurchCRM has Stored Cross-Site Scripting (XSS) In GroupEditor.phpEPSS 0.2%CVE-2025-67875HIGHChurchCRM has stored XSS via Person Property Assignment Leading to Admin Session HijackingEPSS 0.2%CVE-2026-35534HIGHChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute InjectionEPSS 0.2%CVE-2026-42289HIGHChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege EscalationEPSS 0.1%CVE-2026-44548HIGHChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)EPSS 0.1%