Total
55 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-38770 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php. | |||||
| CVE-2023-38773 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php. | |||||
| CVE-2023-38769 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php. | |||||
| CVE-2023-38766 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component. | |||||
| CVE-2023-38767 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php. | |||||
| CVE-2023-38768 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php. | |||||
| CVE-2023-38765 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php. | |||||
| CVE-2023-38764 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php. | |||||
| CVE-2023-38763 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 6.5 MEDIUM |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint. | |||||
| CVE-2023-38760 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component. | |||||
| CVE-2023-38761 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component. | |||||
| CVE-2023-38762 | 1 Churchcrm | 1 Churchcrm | 2023-08-09 | N/A | 7.5 HIGH |
| SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php. | |||||
| CVE-2023-33661 | 1 Churchcrm | 1 Churchcrm | 2023-07-06 | N/A | 6.1 MEDIUM |
| Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. | |||||
| CVE-2022-31325 | 1 Churchcrm | 1 Churchcrm | 2022-11-29 | 6.5 MEDIUM | 7.2 HIGH |
| There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php. | |||||
| CVE-2021-41965 | 1 Churchcrm | 1 Churchcrm | 2022-05-23 | 6.5 MEDIUM | 8.8 HIGH |
| A SQL injection vulnerability exists in ChurchCRM version 2.0.0 to 4.4.5 that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN_tyid, theID and EID fields used when an Edit action on an existing record is being performed. | |||||