Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Churchcrm
(Churchcrm)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 37 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2023-05-04 | CVE-2023-29842 | ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter. | Churchcrm | 8.8 | ||
| 2023-08-11 | CVE-2020-28848 | CSV Injection vulnerability in ChurchCRM version 4.2.0, allows remote attackers to execute arbitrary code via crafted CSV file. | Churchcrm | 8.8 | ||
| 2023-08-11 | CVE-2020-28849 | Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module. | Churchcrm | 5.4 | ||
| 2023-08-08 | CVE-2023-38760 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component. | Churchcrm | 7.5 | ||
| 2023-08-08 | CVE-2023-38761 | Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component. | Churchcrm | 6.1 | ||
| 2023-08-08 | CVE-2023-38762 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php. | Churchcrm | 7.5 | ||
| 2023-08-08 | CVE-2023-38763 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint. | Churchcrm | 6.5 | ||
| 2023-08-08 | CVE-2023-38764 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php. | Churchcrm | 7.5 | ||
| 2023-08-08 | CVE-2023-38765 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php. | Churchcrm | 7.5 | ||
| 2023-08-08 | CVE-2023-38766 | Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component. | Churchcrm | 5.4 |