| CVE-2023-38767 | CAO7.5 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php. | 08/08/2023 |
| CVE-2023-38766 | TRUNG BÌNH5.4 | Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component. | 08/08/2023 |
| CVE-2023-38765 | CAO7.5 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php. | 08/08/2023 |
| CVE-2023-38764 | CAO7.5 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php. | 08/08/2023 |
| CVE-2023-38763 | TRUNG BÌNH6.5 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint. | 08/08/2023 |
| CVE-2023-38762 | CAO7.5 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php. | 08/08/2023 |
| CVE-2023-38761 | TRUNG BÌNH6.1 | Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component. | 08/08/2023 |
| CVE-2023-38760 | CAO7.5 | SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component. | 08/08/2023 |
| CVE-2023-33661 | TRUNG BÌNH6.1 | Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. | 29/06/2023 |
| CVE-2023-31548 | TRUNG BÌNH5.4 | A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | 31/05/2023 |
| CVE-2023-26842 | TRUNG BÌNH5.4 | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. | 31/05/2023 |
| CVE-2023-31699 | TRUNG BÌNH4.8 | ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file. | 17/05/2023 |
| CVE-2023-29842 | CAO8.8 | ChurchCRM 4.5.4 endpoint /EditEventTypes.php is vulnerable to Blind SQL Injection (Time-based) via the EN_tyid POST parameter. | 04/05/2023 |
| CVE-2023-26843 | TRUNG BÌNH5.4 | A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. | 25/04/2023 |
| CVE-2023-26841 | TRUNG BÌNH6.5 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user that is currently logged in. | 25/04/2023 |
| CVE-2023-26840 | TRUNG BÌNH5.3 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an Administrator. | 25/04/2023 |
| CVE-2023-26839 | TRUNG BÌNH4.3 | A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site. | 25/04/2023 |
| CVE-2023-25348 | CAO7.8 | ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new person. These vulnerabilities allow attackers to execute arbitrary code via a crafted excel file. | 25/04/2023 |
| CVE-2023-25347 | TRUNG BÌNH5.4 | A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. These input fields are located in the "Title" Input Field in EventEditor.php. | 25/04/2023 |
| CVE-2023-25346 | TRUNG BÌNH6.1 | A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. | 25/04/2023 |