Filtered by vendor Churchcrm
Subscriptions
Filtered by product Churchcrm
Subscriptions
Total
39 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-33661 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 6.1 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. | ||||
| CVE-2023-31699 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 4.8 Medium |
| ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file. | ||||
| CVE-2023-31548 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.4 Medium |
| A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | ||||
| CVE-2023-29842 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 8.8 High |
| ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter. | ||||
| CVE-2023-27059 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Group Name text field. | ||||
| CVE-2023-26842 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.4 Medium |
| A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. | ||||
| CVE-2023-26855 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 7.5 High |
| The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords. | ||||
| CVE-2023-26840 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.3 Medium |
| A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. | ||||
| CVE-2023-26843 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.4 Medium |
| A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. | ||||
| CVE-2023-26841 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 6.5 Medium |
| A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in. | ||||
| CVE-2023-26839 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 4.3 Medium |
| A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. | ||||
| CVE-2023-25347 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php. | ||||
| CVE-2023-25346 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. | ||||
| CVE-2023-25348 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 7.8 High |
| ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. | ||||
| CVE-2023-24685 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 7.2 High |
| ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module. | ||||
| CVE-2023-24684 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 7.2 High |
| ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php. | ||||
| CVE-2023-24690 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.4 Medium |
| ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family. | ||||
| CVE-2023-24686 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 4.8 Medium |
| An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV file. | ||||
| CVE-2024-36647 | 1 Churchcrm | 1 Churchcrm | 2024-08-02 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under the Register a New Family page. | ||||