Vulnerabilities > Churchcrm > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-08-11 | CVE-2020-28849 | Cross-site Scripting vulnerability in Churchcrm Cross Site Scripting (XSS) vulnerability in ChurchCRM version 4.2.1, allows remote attckers to execute arbitrary code and gain sensitive information via crafted payload in Add New Deposit field in View All Deposit module. | 5.4 |
| 2023-08-08 | CVE-2023-38761 | Cross-site Scripting vulnerability in Churchcrm 5.0.0 Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component. | 6.1 |
| 2023-08-08 | CVE-2023-38763 | SQL Injection vulnerability in Churchcrm 5.0.0 SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint. | 6.5 |
| 2023-08-08 | CVE-2023-38766 | Cross-site Scripting vulnerability in Churchcrm 5.0.0 Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component. | 5.4 |
| 2023-06-29 | CVE-2023-33661 | Cross-site Scripting vulnerability in Churchcrm 4.5.3 Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters. | 6.1 |
| 2023-05-31 | CVE-2023-26842 | Cross-site Scripting vulnerability in Churchcrm 4.5.3 A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the OptionManager.php. | 5.4 |
| 2023-05-31 | CVE-2023-31548 | Cross-site Scripting vulnerability in Churchcrm 4.5.3 A stored Cross-site scripting (XSS) vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | 5.4 |
| 2023-05-17 | CVE-2023-31699 | Cross-site Scripting vulnerability in Churchcrm 4.5.4 ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file. | 4.8 |
| 2023-04-25 | CVE-2023-25346 | Cross-site Scripting vulnerability in Churchcrm 4.5.3 A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found. | 6.1 |
| 2023-04-25 | CVE-2023-25347 | Cross-site Scripting vulnerability in Churchcrm 4.5.3 A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via input fields. | 5.4 |