Technology · ChurchCRM
ChurchCRM vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 41 vulnerabilities in ChurchCRM: 0 in the last 7 days and 0 in the last 90 days, 7 of them critical and 0 exploited in the wild. The most recent, CVE-2026-58410, was published on 13 July 2026.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 7
- Exploited in the wild
- 0
About ChurchCRM
Web-based customer relationship management system designed for churches and religious organizations.
Latest ChurchCRM vulnerabilities
- CVE-2026-58410: ChurchCRM CRM authorization bypass in family-scoped endpointshighCVSS 7.1
- CVE-2026-58409: ChurchCRM unrestricted file upload in plugin installercriticalCVSS 9.1
- CVE-2026-58408: ChurchCRM broken access control in CSVCreateFile.php exportmediumCVSS 6.5
- CVE-2026-44548: ChurchCRM CSRF in legacy delete endpointshighCVSS 8.1
- CVE-2026-44547: ChurchCRM 2FA and account lockout bypass in public API logincriticalCVSS 9.6
- CVE-2026-42289: ChurchCRM CSRF in UserEditor.php leads to privilege escalationhighCVSS 8.8
- CVE-2026-42288: ChurchCRM remote code execution in setup wizardcriticalCVSS 10EPSS 0.3%
- CVE-2026-39941: ChurchCRM is an open-source church management system. Prior to 7.1.0, an XSS vulnerability allows attacker-supplied…mediumCVSS 6.1EPSS 0.3%
- CVE-2026-39344: ChurchCRM reflected XSS in login page username parameterhighCVSS 8.1EPSS 0.3%
- CVE-2026-39343: ChurchCRM SQL injection in EditEventTypes.phphighCVSS 7.2EPSS 0.3%
- CVE-2026-39342: ChurchCRM SQL injection in QueryView.php searchwhat parameterhighCVSS 8.8EPSS 0.3%
- CVE-2026-39341: ChurchCRM SQL injection in ConfirmReportEmail.phphighCVSS 8.1EPSS 0.3%
- CVE-2026-39340: ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in…highCVSS 8.1EPSS 0.2%
- CVE-2026-39339: ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability…criticalCVSS 9.1EPSS 1.4%
- CVE-2026-39338: ChurchCRM is an open-source church management system. Prior to 7.1.0, a Blind Reflected Cross-Site Scripting…mediumCVSS 6.1EPSS 0.2%
- CVE-2026-39337: ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code…criticalCVSS 10EPSS 0.7%
- CVE-2026-39336: ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting issue affects the…mediumCVSS 6.1EPSS 0.2%
- CVE-2026-39335: ChurchCRM is an open-source church management system. Prior to 7.1.1, there is Stored XSS in group remove control and…mediumCVSS 6.1EPSS 0.3%
- CVE-2026-39334: ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the…highCVSS 8.8EPSS 0.3%
- CVE-2026-39333: ChurchCRM is an open-source church management system. Prior to 7.1.0, he FindFundRaiser.php endpoint reflects…highCVSS 8.7EPSS 0.2%
- CVE-2026-39332: ChurchCRM is an open-source church management system. Prior to 7.1.0, a reflected Cross-Site Scripting (XSS)…highCVSS 8.7EPSS 0.2%
- CVE-2026-39331: ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family…highCVSS 8.1EPSS 0.2%
- CVE-2026-39330: ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the…highCVSS 8.8EPSS 0.2%
- CVE-2026-39329: ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in…highCVSS 8.8EPSS 0.2%
- CVE-2026-39328: ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability…highCVSS 8.9EPSS 0.2%
Most severe ChurchCRM vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-39337: ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code…criticalCVSS 10EPSS 0.7%
- CVE-2026-42288: ChurchCRM remote code execution in setup wizardcriticalCVSS 10EPSS 0.3%
- CVE-2026-44547: ChurchCRM 2FA and account lockout bypass in public API logincriticalCVSS 9.6
- CVE-2025-68109: ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality…criticalCVSS 9.1EPSS 1.6%
- CVE-2026-39339: ChurchCRM is an open-source church management system. Prior to 7.1.0, a critical authentication bypass vulnerability…criticalCVSS 9.1EPSS 1.4%
- CVE-2026-35573: ChurchCRM is an open-source church management system. Prior to 6.5.3, a path traversal vulnerability in ChurchCRM's…criticalCVSS 9.1EPSS 0.8%
- CVE-2026-58409: ChurchCRM unrestricted file upload in plugin installercriticalCVSS 9.1
- CVE-2026-39328: ChurchCRM is an open-source church management system. Prior to 7.1.0, a stored cross-site scripting vulnerability…highCVSS 8.9EPSS 0.2%
- CVE-2026-39318: ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in…highCVSS 8.8EPSS 0.3%
- CVE-2026-39342: ChurchCRM SQL injection in QueryView.php searchwhat parameterhighCVSS 8.8EPSS 0.3%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many ChurchCRM vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/churchcrm)<a href="https://junglewise.ai/threats/technologies/churchcrm"><img src="https://junglewise.ai/threats/technologies/churchcrm/badge.svg" alt="ChurchCRM vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/churchcrm.json, and this page as text at https://junglewise.ai/threats/technologies/churchcrm.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "ChurchCRM vulnerabilities", https://junglewise.ai/threats/technologies/churchcrm, 11 November 2026.