Tag
ChurchCRM Stored XSS Vulnerability in Person Property Management
2 rules 1 TTP 2 CVEsA stored cross-site scripting (XSS) vulnerability in ChurchCRM versions prior to 7.0.0 allows authenticated users to inject arbitrary JavaScript code via dynamically assigned person properties, leading to potential session hijacking or account compromise when other users view the affected profile.
ChurchCRM Pre-Authentication Remote Code Execution Vulnerability (CVE-2026-39337)
2 rules 2 TTPs 2 CVEsA critical pre-authentication remote code execution vulnerability in ChurchCRM versions prior to 7.1.0 allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise.
ChurchCRM Authenticated API User Authorization Bypass (CVE-2026-39331)
2 rules 1 TTP 1 CVEAn authenticated API user of ChurchCRM prior to v7.1.0 can bypass authorization checks and modify arbitrary family records by manipulating the familyId parameter in API requests, leading to privilege escalation and potential data manipulation.
ChurchCRM Path Traversal Vulnerability Leading to Remote Code Execution
2 rules 1 TTP 1 CVEA path traversal vulnerability in ChurchCRM versions prior to 6.5.3 allows authenticated administrators to upload arbitrary files, leading to remote code execution by overwriting Apache .htaccess files.
ChurchCRM SQL Injection Vulnerability (CVE-2026-35567)
2 rules 1 TTP 1 CVEChurchCRM versions prior to 7.1.0 are vulnerable to SQL injection via the NewRole POST parameter, allowing authenticated users with the ManageGroups role to execute arbitrary SQL commands.
ChurchCRM Time-Based Blind SQL Injection Vulnerability (CVE-2026-34402)
2 rules 1 TTP 1 CVECVE-2026-34402 is a time-based blind SQL injection vulnerability in ChurchCRM versions prior to 7.1.0. Authenticated users with Edit Records or Manage Groups permissions can exploit the PropertyAssign.php endpoint to exfiltrate or modify database content, including user credentials, PII, and configuration secrets.
ChurchCRM SQL Injection Vulnerability in PropertyTypeEditor.php
2 rules 1 TTP 1 CVEA critical SQL injection vulnerability (CVE-2026-39323) in ChurchCRM versions prior to 7.1.0 allows authenticated users with 'Manage Properties' permission to execute arbitrary SQL commands via unsanitized POST parameters in PropertyTypeEditor.php, leading to potential data exfiltration, modification, or deletion.
ChurchCRM Remote Code Execution via Backup Restore Vulnerability (CVE-2026-40484)
3 rules 2 TTPs 1 CVEChurchCRM versions before 7.2.0 are vulnerable to remote code execution (RCE) due to insufficient file extension filtering during database backup restoration, allowing an authenticated administrator to upload a crafted archive containing a PHP webshell that can be executed via HTTP requests.
ChurchCRM < 7.2.0 Family Record Deletion CSRF Vulnerability
2 rules 1 TTP 1 CVEChurchCRM versions prior to 7.2.0 are vulnerable to a CSRF attack on the family record deletion endpoint allowing an attacker to trigger deletion of family records by enticing an authenticated administrator to visit a malicious page.