--- title: "ChurchCRM vulnerabilities: CVEs, CISA KEV and security advisories" url: https://radicalnotion.ai/vendor/churchcrm type: vendor description: "ChurchCRM has 127 published CVEs, 0 in CISA KEV and 115 with public exploits." updated: 2026-07-13 source: RadicalNotion.AI license: CC BY-NC 4.0 (https://creativecommons.org/licenses/by-nc/4.0/) --- # ChurchCRM vulnerabilities - **Published CVEs:** 127 - **In CISA KEV:** 0 - **With a public exploit:** 115 - **With a patch:** 75 - **Average CVSS:** 7.5 - **CVEs in the last two years:** 79 - **First CVE:** 2022-05-15 - **Latest CVE:** 2026-07-13 ## Severity breakdown | Severity | CVEs | | --- | --- | | Critical | 25 | | High | 62 | | Medium | 38 | | Low | 2 | | Unscored | 0 | ## Most affected products | Product | CVEs | | --- | --- | | [CRM](https://radicalnotion.ai/vendor/churchcrm/crm) | 127 | | [ChurchCRM](https://radicalnotion.ai/vendor/churchcrm/churchcrm) | 110 | | [ChurchCRM Backup Restore Handler](https://radicalnotion.ai/vendor/churchcrm/churchcrm-backup-restore-handler) | 1 | ## Most common weakness types | CWE | Name | CVEs | | --- | --- | --- | | [CWE-89](https://radicalnotion.ai/cwe/cwe-89) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 51 | | [CWE-79](https://radicalnotion.ai/cwe/cwe-79) | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 37 | | [CWE-352](https://radicalnotion.ai/cwe/cwe-352) | Cross-Site Request Forgery (CSRF) | 5 | | [CWE-94](https://radicalnotion.ai/cwe/cwe-94) | Improper Control of Generation of Code ('Code Injection') | 3 | | [CWE-287](https://radicalnotion.ai/cwe/cwe-287) | Improper Authentication | 3 | | [CWE-862](https://radicalnotion.ai/cwe/cwe-862) | Missing Authorization | 3 | | [CWE-639](https://radicalnotion.ai/cwe/cwe-639) | Authorization Bypass Through User-Controlled Key | 2 | | [CWE-434](https://radicalnotion.ai/cwe/cwe-434) | Unrestricted Upload of File with Dangerous Type | 2 | ## Assigning CNAs | CNA | CVEs | | --- | --- | | [GitHub\_M](https://radicalnotion.ai/cna/github-m) | 69 | | [mitre](https://radicalnotion.ai/cna/mitre) | 47 | | [Gridware](https://radicalnotion.ai/cna/gridware) | 7 | | [VulDB](https://radicalnotion.ai/cna/vuldb) | 4 | ## CVEs by year | Year | CVEs published | | --- | --- | | 2022 | 4 | | 2023 | 33 | | 2024 | 11 | | 2025 | 29 | | 2026 | 50 | ## Latest CVEs | CVE | Title | Severity | CVSS | EPSS | CISA KEV | Published | | --- | --- | --- | --- | --- | --- | --- | | CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | high | 7.0 | 0.4% | No | 2026-07-13 | | CVE-2026-58410 | ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records | high | 7.1 | 0.2% | No | 2026-07-13 | | CVE-2026-58409 | ChurchCRM: Authenticated Remote Code Execution (RCE) via Malicious Plugin Upload | critical | 9.1 | 0.6% | No | 2026-07-13 | | CVE-2026-58408 | ChurchCRM : Broken Access Control in \`CSVCreateFile.php\` Allows Low-Privileged Users to Export All Members' PII | medium | 6.5 | 0.4% | No | 2026-07-13 | | CVE-2026-44548 | ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php) | high | 8.1 | 0.1% | No | 2026-05-12 | | CVE-2026-44547 | ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2 | critical | 9.6 | 0.3% | No | 2026-05-12 | | CVE-2026-42288 | ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB\_PASSWORD | critical | 10.0 | 0.7% | No | 2026-05-12 | | CVE-2026-42289 | ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation | high | 8.8 | 0.2% | No | 2026-05-12 | | CVE-2026-40593 | ChurchCRM: Stored XSS in UserEditor.php via Login Name Field | medium | 4.8 | 0.2% | No | 2026-04-18 | | CVE-2026-40581 | ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion | high | 8.1 | 0.2% | No | 2026-04-17 | | CVE-2026-40485 | ChurchCRM: Username Enumeration via Differential Response in Public Login API | medium | 5.3 | 0.3% | No | 2026-04-17 | | CVE-2026-40484 | ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function | critical | 9.1 | 0.9% | No | 2026-04-17 | ## Frequently asked questions ### How many CVEs does ChurchCRM have? ChurchCRM has 127 published CVE records since 2022, including 79 in the last two years. ### How many ChurchCRM CVEs are in CISA KEV? None of ChurchCRM's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog. ### Which ChurchCRM products have the most CVEs? The ChurchCRM products with the most published CVEs are CRM, ChurchCRM, ChurchCRM Backup Restore Handler. ### What are the most common weakness types in ChurchCRM CVEs? ChurchCRM's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-352 (Cross-Site Request Forgery (CSRF)), CWE-94 (Improper Control of Generation of Code ('Code Injection')). ### Are there public exploits for ChurchCRM vulnerabilities? Yes — 115 of ChurchCRM's CVEs have a known public exploit. ### How many critical ChurchCRM vulnerabilities are there? ChurchCRM has 25 critical and 62 high-severity CVEs. ### What is the average severity of ChurchCRM CVEs? The average CVSS base score across ChurchCRM's scored CVEs is 7.5. ## Related vendors - [LibreNMS](https://radicalnotion.ai/vendor/librenms) (128 CVEs) - [RSA](https://radicalnotion.ai/vendor/rsa) (128 CVEs) - [Cap-go](https://radicalnotion.ai/vendor/cap-go) (127 CVEs) - [carmelo](https://radicalnotion.ai/vendor/carmelo) (127 CVEs) - [Accellion](https://radicalnotion.ai/vendor/accellion) (126 CVEs) - [Axis Communications](https://radicalnotion.ai/vendor/axis) (126 CVEs) - [Johnson Controls](https://radicalnotion.ai/vendor/johnson-controls) (126 CVEs) - [libming](https://radicalnotion.ai/vendor/libming) (126 CVEs) --- Source: [RadicalNotion.AI](https://radicalnotion.ai/vendor/churchcrm). Licensed CC BY-NC 4.0; attribute RadicalNotion.AI and link the source page when you reuse this data.