Tag
ChurchCRM Stored XSS Vulnerability in Person Property Management
2 rules 1 TTP 2 CVEsA stored cross-site scripting (XSS) vulnerability in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject arbitrary JavaScript code via dynamically assigned person properties, leading to potential session hijacking or account compromise when other users view the affected profile.
ChurchCRM Pre-Authentication Remote Code Execution Vulnerability (CVE-2026-39337)
2 rules 2 TTPs 2 CVEsA critical pre-authentication remote code execution vulnerability in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise.
ChurchCRM Authenticated API User Authorization Bypass (CVE-2026-39331)
2 rules 1 TTP 1 CVEAn authenticated API user of ChurchCRM prior to v7.1.0 can bypass authorization checks and modify arbitrary family records by manipulating the familyId parameter in API requests, leading to privilege escalation and potential data manipulation.
ChurchCRM Path Traversal Vulnerability Leading to Remote Code Execution
2 rules 1 TTP 1 CVEA path traversal vulnerability in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to upload arbitrary files, leading to remote code execution by overwriting Apache .htaccess files.
ChurchCRM SQL Injection Vulnerability (CVE-2026-35567)
2 rules 1 TTP 1 CVE 2 IOCsChurchCRM versions prior to 7.1.0 are vulnerable to SQL injection via the NewRole POST parameter, allowing authenticated users with the ManageGroups role to execute arbitrary SQL commands.
ChurchCRM Time-Based Blind SQL Injection Vulnerability (CVE-2026-34402)
2 rules 1 TTP 1 CVECVE-2026-34402 is a time-based blind SQL injection vulnerability in ChurchCRM versions prior to 7.1.0. Authenticated users with Edit Records or Manage Groups permissions can exploit the PropertyAssign.php endpoint to exfiltrate or modify database content, including user credentials, PII, and configuration secrets.