Churchcrm
Monthly
Reflected Cross-Site Scripting in ChurchCRM before 7.4.0 lets remote attackers inject JavaScript through unsanitized request parameter names and values reflected into JavaScript-string and HTML-attribute contexts on endpoints such as /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. When a victim (especially an administrator) follows a crafted link, the payload executes in their session, enabling session-token theft, account takeover, and exposure of church member data. No public exploit identified at time of analysis, and the CVSS 4.0 vector (PR:N/UI:A) indicates unauthenticated triggering but requires victim interaction.
Insecure Direct Object Reference in ChurchCRM before 7.4.0 lets an authenticated non-admin user with EditSelf access read and modify other congregations' family records by supplying a different family's familyId to family-scoped endpoints. Because the backend loads the family entity by the attacker-controlled ID without ownership verification, a user who also holds the Notes permission can additionally create notes on unrelated families' records, breaking the intended self-service scope. No public exploit identified at time of analysis, though the flaw is trivially reproducible by manipulating a request parameter.
Remote code execution in ChurchCRM before 7.4.0 lets an authenticated administrator run arbitrary PHP on the server by installing a plugin ZIP that contains a webshell. Because 'php' is explicitly whitelisted in ALLOWED_EXTENSIONS and the DENIED_EXTENSIONS denylist fails to catch standard .php files, any PHP file inside the archive is extracted directly under the web root and becomes immediately executable over HTTP without the plugin ever being enabled. The /plugins/install-url route additionally allows the archive to be sourced from any attacker-controlled HTTPS URL, validated only against an attacker-supplied SHA-256 hash. No public exploit identified at time of analysis and it is not on CISA KEV.
Cross-site request forgery in ChurchCRM before 7.3.2 lets an attacker-controlled web page trigger top-level GET navigation to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, causing an authenticated victim with the relevant role to silently delete fundraiser, property-type, and note records - including cascaded property and record-to-property assignments. Any privileged user who merely visits a malicious page while logged in can have data destroyed without confirmation. Publicly available exploit code exists (SSVC: poc), but there is no public exploit identified in CISA KEV and EPSS is only 0.01%, indicating no observed widespread exploitation.
Authentication bypass in ChurchCRM 7.2.0 through 7.2.2 re-exposes a previously patched flaw (CVE-2026-4058) because the hardening applied to src/api/routes/public/public-user.php was silently removed by an unrelated pull request before any 7.2.x tag was cut. As a result, every shipped 7.2.x release is exploitable using the PoC published with the original advisory, letting an attacker with low-level access defeat the API login endpoint's protections to reach protected data and functions. Publicly available exploit code exists (SSVC: PoC), but EPSS is very low (0.03%) and the flaw is not on the CISA KEV list; fixed in 7.3.1.
Pre-authentication remote code execution in ChurchCRM before 7.3.2 allows unauthenticated attackers to inject and execute arbitrary code through the setup wizard's unsanitized DB_PASSWORD field. This vulnerability exists because the patch for CVE-2026-39337 was incomplete, leaving the original CWE-94 code injection fully exploitable; publicly available exploit code exists (SSVC exploitation status: poc), and CISA's SSVC framework rates it as automatable with total technical impact. Despite the maximum CVSS score of 10.0, EPSS estimates only a 0.27% 30-day exploitation probability (51st percentile), indicating it is not yet observed in widespread automated campaigns.
Cross-site request forgery in ChurchCRM's UserEditor.php (versions prior to 7.3.2) lets an unauthenticated attacker forge account-management requests that execute with an authenticated administrator's session. Because the endpoint processes user creation and permission changes from $_POST parameters with no CSRF token, a victim admin who visits a malicious page can be tricked into silently promoting a low-privilege user to administrator or minting a new admin backdoor account. Publicly available exploit code exists (SSVC: poc) but the flaw is not in CISA KEV, and EPSS is very low (0.02%, 4th percentile), indicating no evidence of widespread exploitation.
Reflected Cross-Site Scripting (XSS) in ChurchCRM login page allows remote attackers to execute arbitrary JavaScript in victims' browsers through malicious URLs containing unsanitized username parameters. ChurchCRM versions prior to 7.1.0 fail to encode the username parameter, enabling attackers to craft URLs that inject malicious scripts capable of stealing session cookies or displaying phishing forms. With CVSS 8.1 (AV:N/AC:L/PR:N/UI:R) and no public exploit identified at time of analysis, this represents a moderate-priority risk requiring user interaction but no authentication for exploitation.
SQL injection in ChurchCRM 7.0.x and earlier allows authenticated administrators to execute arbitrary SQL commands via unsanitized EN_tyid parameter in EditEventTypes.php. While requiring high-privilege administrative access (CVSS PR:H), successful exploitation enables complete database compromise including data exfiltration, modification, and potential server-level access through database features. Patched in version 7.1.0. No public exploit identified at time of analysis, EPSS data not available for assessment.
SQL injection in ChurchCRM's QueryView.php allows authenticated users with Data/Reports access to execute arbitrary SQL commands via the searchwhat parameter when using QueryID=15 (Advanced Search). Affects all versions prior to 7.1.0. CVSS 9.4 critical severity reflects network-accessible attack requiring low privileges with high impact across confidentiality, integrity, and availability. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Vendor-released patch available in version 7.1.0.
Time-based SQL injection in ChurchCRM versions before 7.1.0 allows authenticated remote attackers to extract sensitive database contents through the ConfirmReportEmail.php endpoint. The familyId parameter fails to properly sanitize user input in SQL query construction, enabling attackers with low-privilege accounts to exfiltrate high-value data including confidential church member information. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though the vulnerability class (CWE-89) is well-understood and exploitation techniques are widely documented.
SQL injection in ChurchCRM's PropertyTypeEditor.php allows authenticated users with MenuOptions role permission to exfiltrate database contents including password hashes. The vulnerability stems from replacing SQL-escaping function legacyFilterInput() with sanitizeText() which only strips HTML, leaving Name and Description fields in property type management vulnerable to time-based blind injection. CVSS 8.1 reflects high confidentiality and integrity impact with low attack complexity from network-accessible authenticated attackers. No public exploit identified at time of analysis, though exploitation requires only basic staff-level permissions rather than administrative access.
Authentication bypass in ChurchCRM API middleware enables unauthenticated remote attackers to access all protected endpoints by manipulating URL paths with 'api/public' strings, exposing complete church member databases and system configurations. Affects ChurchCRM versions prior to 7.1.0 with critical CVSS 9.1 rating. EPSS exploitation probability data unavailable; no public exploit code confirmed at time of analysis, though the trivial attack complexity (path manipulation) significantly increases exploitation risk for internet-exposed installations.
Reflected cross-site scripting (XSS) in ChurchCRM's dashboard search parameter allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers. Versions prior to 7.1.0 fail to sanitize user input, enabling payload execution even when server-side validation triggers HTTP 500 errors. The CVSS v4.0 score of 8.6 reflects network accessibility (AV:N), low complexity (AC:L), no authentication required (PR:N), and high confidentiality/integrity impact (VC:H/VI:H). No public exploit identified at time of analysis, though EPSS data is unavailable for risk quantification.
Remote code execution in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to inject arbitrary PHP code through the unsanitized $dbPassword variable during setup wizard initialization, resulting in complete server compromise. This critical flaw (CVSS 10.0) exists as an incomplete fix for CVE-2025-62521 and requires no authentication or user interaction to exploit. The pre-authentication nature and maximum CVSS severity indicate immediate patching priority for all exposed ChurchCRM installations.
Second-order SQL injection in ChurchCRM FundRaiserEditor.php allows authenticated low-privilege users to extract and modify database contents remotely. All versions prior to 7.1.0 are affected. This network-accessible vulnerability requires minimal attack complexity and no user interaction, enabling authenticated attackers to achieve full database compromise (confidentiality, integrity, and availability impact). EPSS data not available; no public exploit identified at time of analysis, though vulnerability details are disclosed in GitHub security advisory.
SQL injection in ChurchCRM 7.0.5 /SettingsIndividual.php endpoint allows authenticated low-privilege users to extract, modify, or delete database contents remotely. The vulnerability exploits insufficient input validation on the type array parameter, enabling arbitrary SQL statement execution. ChurchCRM is an open-source church management system handling sensitive member data including personal information, donations, and pastoral records. Fixed in version 7.1.0. EPSS data unavailable; no public exploit identified at time of analysis; not listed in CISA KEV.
Reflected cross-site scripting (XSS) in ChurchCRM versions prior to 7.1.0 allows authenticated attackers to execute arbitrary JavaScript in victims' browsers via crafted URLs targeting the FindFundRaiser.php endpoint. The vulnerability stems from improper output encoding of DateStart and DateEnd parameters in HTML attributes. CVSS 8.7 reflects the changed scope (S:C) enabling potential session hijacking and account compromise across the church management platform. No public exploit code or active exploitation (CISA KEV) identified at time of analysis, though exploitation probability remains moderate given the authenticated requirement and user interaction dependency.
Reflected XSS in ChurchCRM GeoPage.php enables authenticated attackers to execute arbitrary JavaScript in victims' browsers and hijack administrator sessions without user interaction. The vulnerability affects all versions prior to 7.1.0 and leverages autofocus to automatically trigger malicious payloads when authenticated users are socially engineered into submitting a crafted form. Session cookie theft leads to complete account takeover including administrative privileges. No public exploit identified at time of analysis, though technical details are available in the GitHub security advisory.
Insecure Direct Object Reference (IDOR) in ChurchCRM API allows authenticated low-privilege users to manipulate arbitrary family records without proper authorization checks. Attackers with any valid API credentials can modify family verification status, trigger spam emails, activate/deactivate accounts, and force geocoding operations on any family record by manipulating the familyId parameter in API requests. Affects all ChurchCRM versions prior to 7.1.0. CVSS 8.1 (High) reflects the network-accessible attack vector with low complexity and high integrity/availability impact. No evidence of active exploitation (CISA KEV negative) or public exploit code at time of analysis, but the vulnerability is trivially exploitable given the low attack complexity and published security advisory.
SQL injection in ChurchCRM's /PropertyAssign.php endpoint allows authenticated users with 'Manage Groups & Roles' and 'Edit Records' privileges to execute arbitrary SQL commands through the Value parameter. Affecting all versions prior to 7.1.0, attackers can extract sensitive church membership data, modify database records, or potentially achieve complete database compromise. CVSS 8.8 (High) with network-accessible attack vector and low complexity. No public exploit identified at time of analysis, with EPSS data unavailable. Vendor-released patch: version 7.1.0.
SQL injection in ChurchCRM /EventNames.php allows authenticated users with AddEvent privileges to execute arbitrary SQL commands via the newEvtTypeCntLst parameter during event type creation. The vulnerability reaches an ON DUPLICATE KEY UPDATE clause where user input is interpolated without sanitization, enabling high-impact database manipulation. Affects all versions prior to 7.1.0. No public exploit identified at time of analysis, though EPSS data not available. Attack requires low-privilege authenticated access but presents high confidentiality, integrity, and availability risk (CVSS 8.8).
ChurchCRM church management system versions before 7.1.0 allow authenticated users with EditSelf permission to exfiltrate administrator session cookies through stored XSS in social media profile fields. Attackers chain JavaScript payloads across Facebook, LinkedIn, and X fields using onfocus event handlers to bypass 50-character limits, automatically executing when any user (including administrators) views the malicious profile. No public exploit code or confirmed active exploitation identified at time of analysis, though EPSS data unavailable. CVSS 8.9 reflects high impact but requires authenticated access and user interaction.
SQL injection in ChurchCRM 7.0.5 allows authenticated users with 'Manage Groups & Roles' permission to execute arbitrary SQL commands via the NewRole parameter in /MemberRoleChange.php endpoint. This network-accessible vulnerability requires low-complexity exploitation with no user interaction, enabling complete database compromise including data exfiltration and modification. EPSS data unavailable, no CISA KEV listing indicating no confirmed active exploitation at time of analysis, though CVSS 8.8 (High) reflects significant impact potential. Patched in version 7.1.0.
SQL injection in ChurchCRM PropertyTypeEditor.php allows authenticated users with menu options privileges to execute arbitrary SQL commands via Name and Description parameters, enabling full database compromise including data extraction and modification. Affects all versions before 7.1.0. CVSS 8.8 (High) with network-accessible attack vector requiring low-privilege authentication. EPSS data not available; no confirmed active exploitation (not in CISA KEV), but publicly disclosed via GitHub Security Advisory increases likelihood of future exploitation attempts.
SQL injection in ChurchCRM 7.0.5 allows authenticated administrators to execute arbitrary SQL commands through the /SettingsUser.php endpoint's type array parameter. Attackers with high-privilege administrative access can extract sensitive database contents, modify church records, or potentially escalate privileges within the system. Fixed in version 7.1.0. No public exploit identified at time of analysis, with EPSS probability data unavailable for this recent CVE.
SQL injection in ChurchCRM's PropertyTypeEditor.php allows authenticated users with 'Manage Properties' permission to execute arbitrary SQL commands through unsanitized Name and Description POST parameters. ChurchCRM versions prior to 7.1.0 are affected. The vulnerability relies on inadequate input validation (strip_tags() only) before SQL concatenation, enabling data exfiltration, modification, and deletion. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity once authenticated. EPSS data not provided, but the requirement for authenticated access with specific permissions reduces immediate exploitation surface compared to unauthenticated vulnerabilities.
SQL injection in ChurchCRM GroupPropsFormRowOps.php allows authenticated attackers to execute arbitrary SQL commands and extract, modify, or destroy database contents. The Field parameter accepts unsanitized user input that is inserted directly into SQL queries; while mysqli_real_escape_string() is applied, it fails to escape backtick characters, enabling attackers to break out of SQL identifier context. Affects all versions prior to 7.1.0. With network-accessible attack vector (AV:N), low complexity (AC:L), and requiring only low-privilege authentication (PR:L), this vulnerability poses significant risk to church management systems with authenticated user access. EPSS data not available; no CISA KEV status indicating confirmed active exploitation; exploit scenario is straightforward given the technical details disclosed in the GitHub advisory.
SQL injection in ChurchCRM's SettingsIndividual.php allows authenticated users to extract sensitive database contents including member personal information, financial records, and credentials. Affecting all versions prior to 7.1.0, attackers with low-privilege accounts can escalate to full database compromise via unsanitized POST parameter array keys used directly in SQL queries. EPSS data not available, but the low attack complexity (AC:L) and network accessibility (AV:N) combined with publicly disclosed technical details create elevated risk for exposed installations. Vendor-released patch available in version 7.1.0.
Stored XSS in ChurchCRM Note Editor enables authenticated users to execute arbitrary JavaScript in victims' browsers, leading to session hijacking and privilege escalation against administrators managing sensitive church member data. Affects ChurchCRM versions prior to 6.5.3. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. EPSS and KEV data not provided; no public exploit identified at time of analysis. Vendor patch released in version 6.5.3.
Stored cross-site scripting in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject malicious JavaScript through the Person Property Management subsystem, executing when other users view affected profiles. This vulnerability persists despite previous CVE-2023-38766 patches and enables session hijacking or account compromise through persistent payload execution. No public exploit identified at time of analysis, though CVSS score of 8.7 reflects high impact with cross-site scripting scope allowing privilege escalation beyond the attacker's session context.
Stored Cross-Site Scripting in ChurchCRM admin panel enables session hijacking and administrative account takeover through malicious group names. Authenticated users with group-creation privileges can inject JavaScript that executes when administrators view group listings, stealing session cookies. ChurchCRM versions prior to 6.5.3 are affected. No public exploit identified at time of analysis, with EPSS data unavailable, though the low attack complexity (AC:L) and availability of technical details in the GitHub Security Advisory increase exploitation risk for authenticated internal threats.
Server-Side Request Forgery in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to trigger outbound HTTP/HTTPS requests to arbitrary external hosts by injecting malicious URLs into the Referer header. Attackers with high-privilege access can exploit this to probe internal networks, exfiltrate data, or interact with cloud metadata services. CVSS 7.0 reflects medium-high severity requiring privileged access (PR:H). No public exploit identified at time of analysis, though SSRF exploitation techniques are well-documented. EPSS data not provided, but the requirement for admin credentials significantly reduces real-world attack surface compared to unauthenticated SSRF vulnerabilities.
Remote code execution in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to upload malicious files via path traversal in the backup restore functionality, overwriting Apache .htaccess files to execute arbitrary code. The vulnerability exploits unsanitized user input in RestoreJob.php, enabling attackers with high-privilege access to bypass intended upload restrictions. No public exploit identified at time of analysis, though CVSS 9.1 reflects the critical impact of complete system compromise through changed security scope.
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with ManageGroups role to execute arbitrary SQL commands via the NewRole POST parameter in MemberRoleChange.php. The vulnerability requires low-privilege authentication (PR:L) but permits complete database compromise with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation confirmed at time of analysis, though the attack complexity is low (AC:L) and requires no user interaction.
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary SQL commands via the fund raiser statement report functionality. The vulnerability stems from inadequate input validation of session-based fundraiser identifiers in src/Reports/FundRaiserStatement.php, enabling attackers to achieve complete database compromise including data exfiltration, modification, and potential remote code execution. EPSS exploitation probability and KEV status unavailable, but public advisory exists from GitHub Security (GHSA-grq6-q49f-44xh). No public exploit identified at time of analysis, though SQL injection exploits are well-documented and exploitation complexity is low per CVSS vector (AC:L).
Stored cross-site scripting (XSS) in ChurchCRM versions prior to 7.1.0 enables authenticated users with EditRecords role to inject malicious JavaScript through improperly sanitized Facebook profile fields, executing arbitrary code in administrators' browser sessions and enabling account takeover. The vulnerability exploits inadequate output encoding in PersonView.php where sanitizeText() strips HTML tags but fails to escape quote characters in href attribute contexts. EPSS data not available; no CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the technical barrier is low (CVSS AC:L) for authenticated attackers.
Time-based blind SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with Edit Records or Manage Groups permissions to exfiltrate or modify database content including credentials, PII, and configuration secrets via the PropertyAssign.php endpoint. Attack requires low-privilege authentication (PR:L) but enables high confidentiality and integrity impact through database manipulation. No public exploit identified at time of analysis, though EPSS data was not provided. CVSS 8.1 reflects network-accessible exploitation with low complexity requiring only basic user privileges.
Authenticated SQL injection in ChurchCRM's PaddleNumEditor.php endpoint prior to version 6.7.2 allows any logged-in user to execute arbitrary database queries regardless of their assigned permissions. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read, modify, or delete sensitive church data. Update to version 6.7.2 or later to remediate.
Remote code execution in ChurchCRM versions prior to 6.5.3 allows an authenticated administrator to upload a web shell through the Database Restore function, then upload a .htaccess file to make the shell directly accessible and executable. The flaw is tracked as CVE-2025-68109 with CVSS 3.1 base score 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); the high PR:H metric reflects that the vulnerable restore feature is administrative. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and upgrading to 6.5.3 remediates the issue.
Authorization bypass in ChurchCRM prior to version 7.4.0 exposes the full congregation member directory to any low-privileged authenticated user via the unprotected POST /CSVCreateFile.php endpoint. The endpoint streams a CSV containing complete PII for every Person and Family record in the database without performing a dedicated function-level authorization check, relying instead on a legacy coarse gate that any single non-admin permission flag satisfies. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid low-privilege account - makes this a high-priority remediation for organizations managing sensitive congregation data.
Stored cross-site scripting in ChurchCRM UserEditor.php prior to version 7.2.0 allows authenticated administrators to inject malicious HTML and JavaScript into username fields, which then executes in the browsers of other administrators viewing the user editor page. The vulnerability stems from failure to sanitize usernames before rendering them into HTML input value attributes, and exploitation requires administrator-level privileges combined with user interaction (another admin viewing the compromised user's editor). This is a low-CVSS but real privilege-escalation concern within multi-administrator deployments, particularly where administrators may have differing trust levels.
Open redirect vulnerability in ChurchCRM prior to 7.0.0 allows authenticated users to be redirected to arbitrary URLs via malicious 'linkBack' parameters across multiple application pages, including DonatedItemEditor.php. An attacker can craft a link embedding an attacker-controlled URL that executes when a victim clicks the 'Cancel' button, enabling phishing and credential harvesting attacks. EPSS scoring (0.04%, percentile 11%) indicates low real-world exploitation probability despite authenticated access requirement.
Cross-site scripting (XSS) in ChurchCRM prior to 7.1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript through the EName and EDesc parameters in EditEventAttendees.php, which is rendered without proper output encoding. Successful exploitation requires user interaction (UI:P) and results in session hijacking, credential theft, or malware distribution to victims' browsers. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in ChurchCRM prior to version 7.1.0 allows authenticated administrators with high privileges to inject malicious scripts through configuration fields, Person editor defaults, and self-registration form defaults, which are then rendered without sanitization when accessed by other administrators or users. The vulnerability requires admin interaction to exploit (UI:R) and affects confidentiality and integrity but not availability. No public exploit code or active exploitation has been identified.
Stored XSS in ChurchCRM prior to 7.1.1 allows authenticated administrators to inject malicious scripts via group remove controls and family editor state/country fields. The vulnerability requires high-privilege account access and user interaction to trigger, making it an admin-to-admin attack surface rather than a direct threat to end-users. ChurchCRM 7.1.1 and later contain the fix.
Open redirect vulnerability in ChurchCRM prior to version 7.0.0 allows authenticated users to be redirected to arbitrary URLs via crafted links containing unvalidated redirect parameters, particularly through the 'linkBack' parameter used across multiple application pages including DonatedItemEditor.php. An attacker can create a malicious link that redirects authenticated users to external sites when they interact with UI elements, enabling phishing attacks and credential theft. The vulnerability requires an authenticated user and user interaction (clicking a button), reducing immediate risk but posing moderate concern in social engineering scenarios.
ChurchCRM versions prior to 7.0.2 contain a stored cross-site scripting (XSS) vulnerability in the system settings module where administrative users can inject unescaped JavaScript payloads into JSON-type system settings fields. Any administrator who subsequently views the system settings page will execute the attacker's malicious script, potentially allowing credential theft, session hijacking, or lateral movement within the church organization's administrative infrastructure. The vulnerability has been patched in version 7.0.2, and no evidence of active exploitation in the wild has been reported, though the attack requires only high-level privileges (admin access) and basic user interaction (viewing settings).
Stored cross-site scripting in ChurchCRM versions before 6.8.2 allows authenticated users with group editing permissions to inject malicious JavaScript that executes when other users view affected groups. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires user interaction and can result in session hijacking or unauthorized actions performed on behalf of affected users.
ChurchCRM versions before 6.7.2 contain a stored XSS vulnerability in the event creation feature that allows low-privileged users to inject malicious scripts into event descriptions. These payloads persist in the database and execute when administrators or other users view the affected events, potentially enabling account takeover. Public exploit code exists for this vulnerability, though a patch is available in version 6.7.2.
Stored cross-site scripting combined with an IDOR and broken access control in ChurchCRM versions prior to 6.5.3 enables an authenticated user with both 'Edit Records' and 'Manage Properties and Classifications' permissions to inject a persistent payload into an administrator's profile, which executes when that administrator views their own profile page. Successful exploitation can hijack the administrator's session and lead to full account takeover, but requires the targeted administrator to actively view the profile and is limited to malicious or compromised lower-privileged insiders on unpatched instances. Publicly available exploit code exists; the CVE is not in CISA KEV, and the overall real-world risk is assessed as moderate.
ChurchCRM 6.5.0 and earlier reflect submitted plaintext passwords back into subsequent HTTP responses, and the confirmed instance in the vendor patch is the system-settings handler that re-displayed password-type default values to a privileged administrator. Reaching the flaw requires an authenticated high-privilege session (CVSS PR:H), and the impact is confidentiality-only, so real-world risk escalates mainly when the leaked response is captured through a companion XSS, IDOR, or session-fixation flaw; publicly available exploit code exists, there is no CISA KEV entry indicating confirmed active exploitation, and EPSS is low at 0.36% (27th percentile). Upgrading to 6.5.0 removes the exposure entirely.
An authenticated SQL injection in ChurchCRM before 6.5.0 lets a user who holds the event-management permission (isAddEvent) execute arbitrary SQL by supplying a crafted EN_tyid parameter while creating or editing an event in EventEditor.php. Exploitation is gated by a valid login plus that specific capability rather than being reachable anonymously, but it yields full confidentiality, integrity, and availability impact on the backend database once triggered. Publicly available exploit code exists, and the flaw is fully remediated in ChurchCRM 6.5.0; there is no indication of confirmed active exploitation (not in CISA KEV).
ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.
Path traversal in ChurchCRM's Backup Restore Handler allows high-privileged remote attackers to manipulate the restoreFile argument and access arbitrary files on the system. The vulnerability affects ChurchCRM up to version 5.18.0, requires administrative privileges (PR:H), and has publicly available exploit code. While CVSS score is low (2.0) due to privilege requirements, the limited scope impact and vendor non-response elevate practical risk for deployments with exposed admin interfaces.
Unsafe deserialization in ChurchCRM setup/routes/setup.php allows remote attackers to manipulate DB_PASSWORD, ROOT_PATH, or URL parameters, leading to arbitrary code execution with limited impact. The vulnerability affects versions up to 5.18.0 and has publicly available exploit code, though EPSS exploitation probability remains low at 0.10% percentile, suggesting real-world exploitation is constrained by high attack complexity and difficult exploitability factors.
Authentication bypass in ChurchCRM up to version 5.18.0 allows unauthenticated remote attackers to access API endpoints due to a missing authentication check in the AuthMiddleware component. The publicly available exploit permits trivial remote access to sensitive member data, and a patch has been committed. While EPSS indicates low exploitation probability (0.11%) and no active exploitation is confirmed, the vulnerability presents a moderate risk for exposed ChurchCRM instances.
A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XSS) in the EditEventAttendees.php page. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ChurchCRM is an open-source church management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter of /EventAttendance.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Reflected Cross-Site Scripting in ChurchCRM before 7.4.0 lets remote attackers inject JavaScript through unsanitized request parameter names and values reflected into JavaScript-string and HTML-attribute contexts on endpoints such as /FamilyCustomFieldsEditor.php, /PaddleNumList.php, and /admin/system/church-info. When a victim (especially an administrator) follows a crafted link, the payload executes in their session, enabling session-token theft, account takeover, and exposure of church member data. No public exploit identified at time of analysis, and the CVSS 4.0 vector (PR:N/UI:A) indicates unauthenticated triggering but requires victim interaction.
Insecure Direct Object Reference in ChurchCRM before 7.4.0 lets an authenticated non-admin user with EditSelf access read and modify other congregations' family records by supplying a different family's familyId to family-scoped endpoints. Because the backend loads the family entity by the attacker-controlled ID without ownership verification, a user who also holds the Notes permission can additionally create notes on unrelated families' records, breaking the intended self-service scope. No public exploit identified at time of analysis, though the flaw is trivially reproducible by manipulating a request parameter.
Remote code execution in ChurchCRM before 7.4.0 lets an authenticated administrator run arbitrary PHP on the server by installing a plugin ZIP that contains a webshell. Because 'php' is explicitly whitelisted in ALLOWED_EXTENSIONS and the DENIED_EXTENSIONS denylist fails to catch standard .php files, any PHP file inside the archive is extracted directly under the web root and becomes immediately executable over HTTP without the plugin ever being enabled. The /plugins/install-url route additionally allows the archive to be sourced from any attacker-controlled HTTPS URL, validated only against an attacker-supplied SHA-256 hash. No public exploit identified at time of analysis and it is not on CISA KEV.
Cross-site request forgery in ChurchCRM before 7.3.2 lets an attacker-controlled web page trigger top-level GET navigation to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php, causing an authenticated victim with the relevant role to silently delete fundraiser, property-type, and note records - including cascaded property and record-to-property assignments. Any privileged user who merely visits a malicious page while logged in can have data destroyed without confirmation. Publicly available exploit code exists (SSVC: poc), but there is no public exploit identified in CISA KEV and EPSS is only 0.01%, indicating no observed widespread exploitation.
Authentication bypass in ChurchCRM 7.2.0 through 7.2.2 re-exposes a previously patched flaw (CVE-2026-4058) because the hardening applied to src/api/routes/public/public-user.php was silently removed by an unrelated pull request before any 7.2.x tag was cut. As a result, every shipped 7.2.x release is exploitable using the PoC published with the original advisory, letting an attacker with low-level access defeat the API login endpoint's protections to reach protected data and functions. Publicly available exploit code exists (SSVC: PoC), but EPSS is very low (0.03%) and the flaw is not on the CISA KEV list; fixed in 7.3.1.
Pre-authentication remote code execution in ChurchCRM before 7.3.2 allows unauthenticated attackers to inject and execute arbitrary code through the setup wizard's unsanitized DB_PASSWORD field. This vulnerability exists because the patch for CVE-2026-39337 was incomplete, leaving the original CWE-94 code injection fully exploitable; publicly available exploit code exists (SSVC exploitation status: poc), and CISA's SSVC framework rates it as automatable with total technical impact. Despite the maximum CVSS score of 10.0, EPSS estimates only a 0.27% 30-day exploitation probability (51st percentile), indicating it is not yet observed in widespread automated campaigns.
Cross-site request forgery in ChurchCRM's UserEditor.php (versions prior to 7.3.2) lets an unauthenticated attacker forge account-management requests that execute with an authenticated administrator's session. Because the endpoint processes user creation and permission changes from $_POST parameters with no CSRF token, a victim admin who visits a malicious page can be tricked into silently promoting a low-privilege user to administrator or minting a new admin backdoor account. Publicly available exploit code exists (SSVC: poc) but the flaw is not in CISA KEV, and EPSS is very low (0.02%, 4th percentile), indicating no evidence of widespread exploitation.
Reflected Cross-Site Scripting (XSS) in ChurchCRM login page allows remote attackers to execute arbitrary JavaScript in victims' browsers through malicious URLs containing unsanitized username parameters. ChurchCRM versions prior to 7.1.0 fail to encode the username parameter, enabling attackers to craft URLs that inject malicious scripts capable of stealing session cookies or displaying phishing forms. With CVSS 8.1 (AV:N/AC:L/PR:N/UI:R) and no public exploit identified at time of analysis, this represents a moderate-priority risk requiring user interaction but no authentication for exploitation.
SQL injection in ChurchCRM 7.0.x and earlier allows authenticated administrators to execute arbitrary SQL commands via unsanitized EN_tyid parameter in EditEventTypes.php. While requiring high-privilege administrative access (CVSS PR:H), successful exploitation enables complete database compromise including data exfiltration, modification, and potential server-level access through database features. Patched in version 7.1.0. No public exploit identified at time of analysis, EPSS data not available for assessment.
SQL injection in ChurchCRM's QueryView.php allows authenticated users with Data/Reports access to execute arbitrary SQL commands via the searchwhat parameter when using QueryID=15 (Advanced Search). Affects all versions prior to 7.1.0. CVSS 9.4 critical severity reflects network-accessible attack requiring low privileges with high impact across confidentiality, integrity, and availability. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis. Vendor-released patch available in version 7.1.0.
Time-based SQL injection in ChurchCRM versions before 7.1.0 allows authenticated remote attackers to extract sensitive database contents through the ConfirmReportEmail.php endpoint. The familyId parameter fails to properly sanitize user input in SQL query construction, enabling attackers with low-privilege accounts to exfiltrate high-value data including confidential church member information. EPSS data not available; no confirmed active exploitation (CISA KEV) or public exploit code identified at time of analysis, though the vulnerability class (CWE-89) is well-understood and exploitation techniques are widely documented.
SQL injection in ChurchCRM's PropertyTypeEditor.php allows authenticated users with MenuOptions role permission to exfiltrate database contents including password hashes. The vulnerability stems from replacing SQL-escaping function legacyFilterInput() with sanitizeText() which only strips HTML, leaving Name and Description fields in property type management vulnerable to time-based blind injection. CVSS 8.1 reflects high confidentiality and integrity impact with low attack complexity from network-accessible authenticated attackers. No public exploit identified at time of analysis, though exploitation requires only basic staff-level permissions rather than administrative access.
Authentication bypass in ChurchCRM API middleware enables unauthenticated remote attackers to access all protected endpoints by manipulating URL paths with 'api/public' strings, exposing complete church member databases and system configurations. Affects ChurchCRM versions prior to 7.1.0 with critical CVSS 9.1 rating. EPSS exploitation probability data unavailable; no public exploit code confirmed at time of analysis, though the trivial attack complexity (path manipulation) significantly increases exploitation risk for internet-exposed installations.
Reflected cross-site scripting (XSS) in ChurchCRM's dashboard search parameter allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers. Versions prior to 7.1.0 fail to sanitize user input, enabling payload execution even when server-side validation triggers HTTP 500 errors. The CVSS v4.0 score of 8.6 reflects network accessibility (AV:N), low complexity (AC:L), no authentication required (PR:N), and high confidentiality/integrity impact (VC:H/VI:H). No public exploit identified at time of analysis, though EPSS data is unavailable for risk quantification.
Remote code execution in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to inject arbitrary PHP code through the unsanitized $dbPassword variable during setup wizard initialization, resulting in complete server compromise. This critical flaw (CVSS 10.0) exists as an incomplete fix for CVE-2025-62521 and requires no authentication or user interaction to exploit. The pre-authentication nature and maximum CVSS severity indicate immediate patching priority for all exposed ChurchCRM installations.
Second-order SQL injection in ChurchCRM FundRaiserEditor.php allows authenticated low-privilege users to extract and modify database contents remotely. All versions prior to 7.1.0 are affected. This network-accessible vulnerability requires minimal attack complexity and no user interaction, enabling authenticated attackers to achieve full database compromise (confidentiality, integrity, and availability impact). EPSS data not available; no public exploit identified at time of analysis, though vulnerability details are disclosed in GitHub security advisory.
SQL injection in ChurchCRM 7.0.5 /SettingsIndividual.php endpoint allows authenticated low-privilege users to extract, modify, or delete database contents remotely. The vulnerability exploits insufficient input validation on the type array parameter, enabling arbitrary SQL statement execution. ChurchCRM is an open-source church management system handling sensitive member data including personal information, donations, and pastoral records. Fixed in version 7.1.0. EPSS data unavailable; no public exploit identified at time of analysis; not listed in CISA KEV.
Reflected cross-site scripting (XSS) in ChurchCRM versions prior to 7.1.0 allows authenticated attackers to execute arbitrary JavaScript in victims' browsers via crafted URLs targeting the FindFundRaiser.php endpoint. The vulnerability stems from improper output encoding of DateStart and DateEnd parameters in HTML attributes. CVSS 8.7 reflects the changed scope (S:C) enabling potential session hijacking and account compromise across the church management platform. No public exploit code or active exploitation (CISA KEV) identified at time of analysis, though exploitation probability remains moderate given the authenticated requirement and user interaction dependency.
Reflected XSS in ChurchCRM GeoPage.php enables authenticated attackers to execute arbitrary JavaScript in victims' browsers and hijack administrator sessions without user interaction. The vulnerability affects all versions prior to 7.1.0 and leverages autofocus to automatically trigger malicious payloads when authenticated users are socially engineered into submitting a crafted form. Session cookie theft leads to complete account takeover including administrative privileges. No public exploit identified at time of analysis, though technical details are available in the GitHub security advisory.
Insecure Direct Object Reference (IDOR) in ChurchCRM API allows authenticated low-privilege users to manipulate arbitrary family records without proper authorization checks. Attackers with any valid API credentials can modify family verification status, trigger spam emails, activate/deactivate accounts, and force geocoding operations on any family record by manipulating the familyId parameter in API requests. Affects all ChurchCRM versions prior to 7.1.0. CVSS 8.1 (High) reflects the network-accessible attack vector with low complexity and high integrity/availability impact. No evidence of active exploitation (CISA KEV negative) or public exploit code at time of analysis, but the vulnerability is trivially exploitable given the low attack complexity and published security advisory.
SQL injection in ChurchCRM's /PropertyAssign.php endpoint allows authenticated users with 'Manage Groups & Roles' and 'Edit Records' privileges to execute arbitrary SQL commands through the Value parameter. Affecting all versions prior to 7.1.0, attackers can extract sensitive church membership data, modify database records, or potentially achieve complete database compromise. CVSS 8.8 (High) with network-accessible attack vector and low complexity. No public exploit identified at time of analysis, with EPSS data unavailable. Vendor-released patch: version 7.1.0.
SQL injection in ChurchCRM /EventNames.php allows authenticated users with AddEvent privileges to execute arbitrary SQL commands via the newEvtTypeCntLst parameter during event type creation. The vulnerability reaches an ON DUPLICATE KEY UPDATE clause where user input is interpolated without sanitization, enabling high-impact database manipulation. Affects all versions prior to 7.1.0. No public exploit identified at time of analysis, though EPSS data not available. Attack requires low-privilege authenticated access but presents high confidentiality, integrity, and availability risk (CVSS 8.8).
ChurchCRM church management system versions before 7.1.0 allow authenticated users with EditSelf permission to exfiltrate administrator session cookies through stored XSS in social media profile fields. Attackers chain JavaScript payloads across Facebook, LinkedIn, and X fields using onfocus event handlers to bypass 50-character limits, automatically executing when any user (including administrators) views the malicious profile. No public exploit code or confirmed active exploitation identified at time of analysis, though EPSS data unavailable. CVSS 8.9 reflects high impact but requires authenticated access and user interaction.
SQL injection in ChurchCRM 7.0.5 allows authenticated users with 'Manage Groups & Roles' permission to execute arbitrary SQL commands via the NewRole parameter in /MemberRoleChange.php endpoint. This network-accessible vulnerability requires low-complexity exploitation with no user interaction, enabling complete database compromise including data exfiltration and modification. EPSS data unavailable, no CISA KEV listing indicating no confirmed active exploitation at time of analysis, though CVSS 8.8 (High) reflects significant impact potential. Patched in version 7.1.0.
SQL injection in ChurchCRM PropertyTypeEditor.php allows authenticated users with menu options privileges to execute arbitrary SQL commands via Name and Description parameters, enabling full database compromise including data extraction and modification. Affects all versions before 7.1.0. CVSS 8.8 (High) with network-accessible attack vector requiring low-privilege authentication. EPSS data not available; no confirmed active exploitation (not in CISA KEV), but publicly disclosed via GitHub Security Advisory increases likelihood of future exploitation attempts.
SQL injection in ChurchCRM 7.0.5 allows authenticated administrators to execute arbitrary SQL commands through the /SettingsUser.php endpoint's type array parameter. Attackers with high-privilege administrative access can extract sensitive database contents, modify church records, or potentially escalate privileges within the system. Fixed in version 7.1.0. No public exploit identified at time of analysis, with EPSS probability data unavailable for this recent CVE.
SQL injection in ChurchCRM's PropertyTypeEditor.php allows authenticated users with 'Manage Properties' permission to execute arbitrary SQL commands through unsanitized Name and Description POST parameters. ChurchCRM versions prior to 7.1.0 are affected. The vulnerability relies on inadequate input validation (strip_tags() only) before SQL concatenation, enabling data exfiltration, modification, and deletion. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, though the attack vector is network-accessible with low complexity once authenticated. EPSS data not provided, but the requirement for authenticated access with specific permissions reduces immediate exploitation surface compared to unauthenticated vulnerabilities.
SQL injection in ChurchCRM GroupPropsFormRowOps.php allows authenticated attackers to execute arbitrary SQL commands and extract, modify, or destroy database contents. The Field parameter accepts unsanitized user input that is inserted directly into SQL queries; while mysqli_real_escape_string() is applied, it fails to escape backtick characters, enabling attackers to break out of SQL identifier context. Affects all versions prior to 7.1.0. With network-accessible attack vector (AV:N), low complexity (AC:L), and requiring only low-privilege authentication (PR:L), this vulnerability poses significant risk to church management systems with authenticated user access. EPSS data not available; no CISA KEV status indicating confirmed active exploitation; exploit scenario is straightforward given the technical details disclosed in the GitHub advisory.
SQL injection in ChurchCRM's SettingsIndividual.php allows authenticated users to extract sensitive database contents including member personal information, financial records, and credentials. Affecting all versions prior to 7.1.0, attackers with low-privilege accounts can escalate to full database compromise via unsanitized POST parameter array keys used directly in SQL queries. EPSS data not available, but the low attack complexity (AC:L) and network accessibility (AV:N) combined with publicly disclosed technical details create elevated risk for exposed installations. Vendor-released patch available in version 7.1.0.
Stored XSS in ChurchCRM Note Editor enables authenticated users to execute arbitrary JavaScript in victims' browsers, leading to session hijacking and privilege escalation against administrators managing sensitive church member data. Affects ChurchCRM versions prior to 6.5.3. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. EPSS and KEV data not provided; no public exploit identified at time of analysis. Vendor patch released in version 6.5.3.
Stored cross-site scripting in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject malicious JavaScript through the Person Property Management subsystem, executing when other users view affected profiles. This vulnerability persists despite previous CVE-2023-38766 patches and enables session hijacking or account compromise through persistent payload execution. No public exploit identified at time of analysis, though CVSS score of 8.7 reflects high impact with cross-site scripting scope allowing privilege escalation beyond the attacker's session context.
Stored Cross-Site Scripting in ChurchCRM admin panel enables session hijacking and administrative account takeover through malicious group names. Authenticated users with group-creation privileges can inject JavaScript that executes when administrators view group listings, stealing session cookies. ChurchCRM versions prior to 6.5.3 are affected. No public exploit identified at time of analysis, with EPSS data unavailable, though the low attack complexity (AC:L) and availability of technical details in the GitHub Security Advisory increase exploitation risk for authenticated internal threats.
Server-Side Request Forgery in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to trigger outbound HTTP/HTTPS requests to arbitrary external hosts by injecting malicious URLs into the Referer header. Attackers with high-privilege access can exploit this to probe internal networks, exfiltrate data, or interact with cloud metadata services. CVSS 7.0 reflects medium-high severity requiring privileged access (PR:H). No public exploit identified at time of analysis, though SSRF exploitation techniques are well-documented. EPSS data not provided, but the requirement for admin credentials significantly reduces real-world attack surface compared to unauthenticated SSRF vulnerabilities.
Remote code execution in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to upload malicious files via path traversal in the backup restore functionality, overwriting Apache .htaccess files to execute arbitrary code. The vulnerability exploits unsanitized user input in RestoreJob.php, enabling attackers with high-privilege access to bypass intended upload restrictions. No public exploit identified at time of analysis, though CVSS 9.1 reflects the critical impact of complete system compromise through changed security scope.
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with ManageGroups role to execute arbitrary SQL commands via the NewRole POST parameter in MemberRoleChange.php. The vulnerability requires low-privilege authentication (PR:L) but permits complete database compromise with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation confirmed at time of analysis, though the attack complexity is low (AC:L) and requires no user interaction.
SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with low privileges to execute arbitrary SQL commands via the fund raiser statement report functionality. The vulnerability stems from inadequate input validation of session-based fundraiser identifiers in src/Reports/FundRaiserStatement.php, enabling attackers to achieve complete database compromise including data exfiltration, modification, and potential remote code execution. EPSS exploitation probability and KEV status unavailable, but public advisory exists from GitHub Security (GHSA-grq6-q49f-44xh). No public exploit identified at time of analysis, though SQL injection exploits are well-documented and exploitation complexity is low per CVSS vector (AC:L).
Stored cross-site scripting (XSS) in ChurchCRM versions prior to 7.1.0 enables authenticated users with EditRecords role to inject malicious JavaScript through improperly sanitized Facebook profile fields, executing arbitrary code in administrators' browser sessions and enabling account takeover. The vulnerability exploits inadequate output encoding in PersonView.php where sanitizeText() strips HTML tags but fails to escape quote characters in href attribute contexts. EPSS data not available; no CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the technical barrier is low (CVSS AC:L) for authenticated attackers.
Time-based blind SQL injection in ChurchCRM versions prior to 7.1.0 allows authenticated users with Edit Records or Manage Groups permissions to exfiltrate or modify database content including credentials, PII, and configuration secrets via the PropertyAssign.php endpoint. Attack requires low-privilege authentication (PR:L) but enables high confidentiality and integrity impact through database manipulation. No public exploit identified at time of analysis, though EPSS data was not provided. CVSS 8.1 reflects network-accessible exploitation with low complexity requiring only basic user privileges.
Authenticated SQL injection in ChurchCRM's PaddleNumEditor.php endpoint prior to version 6.7.2 allows any logged-in user to execute arbitrary database queries regardless of their assigned permissions. Public exploit code exists for this vulnerability, enabling attackers with valid credentials to read, modify, or delete sensitive church data. Update to version 6.7.2 or later to remediate.
Remote code execution in ChurchCRM versions prior to 6.5.3 allows an authenticated administrator to upload a web shell through the Database Restore function, then upload a .htaccess file to make the shell directly accessible and executable. The flaw is tracked as CVE-2025-68109 with CVSS 3.1 base score 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H); the high PR:H metric reflects that the vulnerable restore feature is administrative. Publicly available exploit code exists, but there is no confirmed active exploitation (CISA KEV) in the provided data, and upgrading to 6.5.3 remediates the issue.
Authorization bypass in ChurchCRM prior to version 7.4.0 exposes the full congregation member directory to any low-privileged authenticated user via the unprotected POST /CSVCreateFile.php endpoint. The endpoint streams a CSV containing complete PII for every Person and Family record in the database without performing a dedicated function-level authorization check, relying instead on a legacy coarse gate that any single non-admin permission flag satisfies. No public exploit has been identified at time of analysis, but the trivially low exploitation barrier - any valid low-privilege account - makes this a high-priority remediation for organizations managing sensitive congregation data.
Stored cross-site scripting in ChurchCRM UserEditor.php prior to version 7.2.0 allows authenticated administrators to inject malicious HTML and JavaScript into username fields, which then executes in the browsers of other administrators viewing the user editor page. The vulnerability stems from failure to sanitize usernames before rendering them into HTML input value attributes, and exploitation requires administrator-level privileges combined with user interaction (another admin viewing the compromised user's editor). This is a low-CVSS but real privilege-escalation concern within multi-administrator deployments, particularly where administrators may have differing trust levels.
Open redirect vulnerability in ChurchCRM prior to 7.0.0 allows authenticated users to be redirected to arbitrary URLs via malicious 'linkBack' parameters across multiple application pages, including DonatedItemEditor.php. An attacker can craft a link embedding an attacker-controlled URL that executes when a victim clicks the 'Cancel' button, enabling phishing and credential harvesting attacks. EPSS scoring (0.04%, percentile 11%) indicates low real-world exploitation probability despite authenticated access requirement.
Cross-site scripting (XSS) in ChurchCRM prior to 7.1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript through the EName and EDesc parameters in EditEventAttendees.php, which is rendered without proper output encoding. Successful exploitation requires user interaction (UI:P) and results in session hijacking, credential theft, or malware distribution to victims' browsers. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in ChurchCRM prior to version 7.1.0 allows authenticated administrators with high privileges to inject malicious scripts through configuration fields, Person editor defaults, and self-registration form defaults, which are then rendered without sanitization when accessed by other administrators or users. The vulnerability requires admin interaction to exploit (UI:R) and affects confidentiality and integrity but not availability. No public exploit code or active exploitation has been identified.
Stored XSS in ChurchCRM prior to 7.1.1 allows authenticated administrators to inject malicious scripts via group remove controls and family editor state/country fields. The vulnerability requires high-privilege account access and user interaction to trigger, making it an admin-to-admin attack surface rather than a direct threat to end-users. ChurchCRM 7.1.1 and later contain the fix.
Open redirect vulnerability in ChurchCRM prior to version 7.0.0 allows authenticated users to be redirected to arbitrary URLs via crafted links containing unvalidated redirect parameters, particularly through the 'linkBack' parameter used across multiple application pages including DonatedItemEditor.php. An attacker can create a malicious link that redirects authenticated users to external sites when they interact with UI elements, enabling phishing attacks and credential theft. The vulnerability requires an authenticated user and user interaction (clicking a button), reducing immediate risk but posing moderate concern in social engineering scenarios.
ChurchCRM versions prior to 7.0.2 contain a stored cross-site scripting (XSS) vulnerability in the system settings module where administrative users can inject unescaped JavaScript payloads into JSON-type system settings fields. Any administrator who subsequently views the system settings page will execute the attacker's malicious script, potentially allowing credential theft, session hijacking, or lateral movement within the church organization's administrative infrastructure. The vulnerability has been patched in version 7.0.2, and no evidence of active exploitation in the wild has been reported, though the attack requires only high-level privileges (admin access) and basic user interaction (viewing settings).
Stored cross-site scripting in ChurchCRM versions before 6.8.2 allows authenticated users with group editing permissions to inject malicious JavaScript that executes when other users view affected groups. Public exploit code exists for this vulnerability, and no patch is currently available. The attack requires user interaction and can result in session hijacking or unauthorized actions performed on behalf of affected users.
ChurchCRM versions before 6.7.2 contain a stored XSS vulnerability in the event creation feature that allows low-privileged users to inject malicious scripts into event descriptions. These payloads persist in the database and execute when administrators or other users view the affected events, potentially enabling account takeover. Public exploit code exists for this vulnerability, though a patch is available in version 6.7.2.
Stored cross-site scripting combined with an IDOR and broken access control in ChurchCRM versions prior to 6.5.3 enables an authenticated user with both 'Edit Records' and 'Manage Properties and Classifications' permissions to inject a persistent payload into an administrator's profile, which executes when that administrator views their own profile page. Successful exploitation can hijack the administrator's session and lead to full account takeover, but requires the targeted administrator to actively view the profile and is limited to malicious or compromised lower-privileged insiders on unpatched instances. Publicly available exploit code exists; the CVE is not in CISA KEV, and the overall real-world risk is assessed as moderate.
ChurchCRM 6.5.0 and earlier reflect submitted plaintext passwords back into subsequent HTTP responses, and the confirmed instance in the vendor patch is the system-settings handler that re-displayed password-type default values to a privileged administrator. Reaching the flaw requires an authenticated high-privilege session (CVSS PR:H), and the impact is confidentiality-only, so real-world risk escalates mainly when the leaked response is captured through a companion XSS, IDOR, or session-fixation flaw; publicly available exploit code exists, there is no CISA KEV entry indicating confirmed active exploitation, and EPSS is low at 0.36% (27th percentile). Upgrading to 6.5.0 removes the exposure entirely.
An authenticated SQL injection in ChurchCRM before 6.5.0 lets a user who holds the event-management permission (isAddEvent) execute arbitrary SQL by supplying a crafted EN_tyid parameter while creating or editing an event in EventEditor.php. Exploitation is gated by a valid login plus that specific capability rather than being reachable anonymously, but it yields full confidentiality, integrity, and availability impact on the backend database once triggered. Publicly available exploit code exists, and the flaw is fully remediated in ChurchCRM 6.5.0; there is no indication of confirmed active exploitation (not in CISA KEV).
ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.
Path traversal in ChurchCRM's Backup Restore Handler allows high-privileged remote attackers to manipulate the restoreFile argument and access arbitrary files on the system. The vulnerability affects ChurchCRM up to version 5.18.0, requires administrative privileges (PR:H), and has publicly available exploit code. While CVSS score is low (2.0) due to privilege requirements, the limited scope impact and vendor non-response elevate practical risk for deployments with exposed admin interfaces.
Unsafe deserialization in ChurchCRM setup/routes/setup.php allows remote attackers to manipulate DB_PASSWORD, ROOT_PATH, or URL parameters, leading to arbitrary code execution with limited impact. The vulnerability affects versions up to 5.18.0 and has publicly available exploit code, though EPSS exploitation probability remains low at 0.10% percentile, suggesting real-world exploitation is constrained by high attack complexity and difficult exploitability factors.
Authentication bypass in ChurchCRM up to version 5.18.0 allows unauthenticated remote attackers to access API endpoints due to a missing authentication check in the AuthMiddleware component. The publicly available exploit permits trivial remote access to sensitive member data, and a patch has been committed. While EPSS indicates low exploitation probability (0.11%) and no active exploitation is confirmed, the vulnerability presents a moderate risk for exposed ChurchCRM instances.
A vulnerability, which was classified as problematic, has been found in ChurchCRM 5.16.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blind SQL Injection vulnerability in the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection vulnerability in the EditEventAttendees. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XSS) in the EditEventAttendees.php page. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a time-based blind SQL Injection vulnerability in the EditEventTypes. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to hijack a user's session by exploiting a Stored Cross Site Scripting (XSS) vulnerability in the Group Editor page. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
ChurchCRM is an open-source church management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability in Church CRM v5.8.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Family Name parameter under. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter of /EventAttendance.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.