These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross-Site Scripting (XSS) vulnerability was identified in ChurchCRM, an open-source church management system, prior to version 7.4.0. The vulnerability is due to insufficient output encoding of user-controlled request parameter names and parameter values. The application reflects attacker-controlled input into JavaScript string contexts and HTML attribute contexts without proper sanitization or context [truncated]
CVE-2026-58410 is an authorization flaw in ChurchCRM, an open-source church management system. Prior to version 7.4.0, low-privileged users with EditSelf access can read and modify other families' records by supplying another family's familyId. The backend trusts the attacker-controlled familyId and loads the corresponding family entity by ID without verifying that the requested family belongs to the curr [truncated]
CVE-2026-58409 is a critical vulnerability in ChurchCRM, an open-source church management system. An authenticated administrator can achieve Remote Code Execution (RCE) on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWED_EXTENSIONS list, while the dangerous extensions denylist (DENIED_EXTENSIONS) fails to block stan [truncated]
A low-privileged user can bypass the /admin/export UI and exfiltrate the entire member directory in ChurchCRM prior to version 7.4.0. The POST /CSVCreateFile.php endpoint generates and streams a CSV containing the full Personally Identifiable Information (PII) of every Person/Family record in the database, without performing any feature-level or object-level authorization check beyond the coarse 'has any [truncated]
ChurchCRM versions prior to 7.3.2 contain a pre-authentication remote code execution vulnerability in the setup wizard. The vulnerability stems from incomplete remediation of CVE-2026-39337, with the DB_PASSWORD parameter remaining unsanitized and exploitable for code injection. The CVSS 3.1 score of 10.0 reflects network attack vector, low complexity, no privileges required, no user interaction, and chan [truncated]
A Reflected Cross-Site Scripting (XSS) vulnerability exists in ChurchCRM, an open-source church management system, prior to version 7.1.0. The vulnerability is located on the login page and is caused by the lack of sanitization or encoding of the username parameter received from the URL. The username parameter value is directly displayed in the login page input element without filter, allowing attackers t [truncated]
CVE-2026-39343 is a SQL injection vulnerability in ChurchCRM, a church management system, prior to version 7.1.0. The vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The EN_tyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute arbitrary SQL commands directly against the database. This vulnerability is fi [truncated]
A SQL injection vulnerability exists in ChurchCRM, a church management system. The vulnerability is located in the searchwhat parameter of QueryView.php when accessed with QueryID=15. An authenticated user with access to Data/Reports > Query Menu and the 'Advanced Search' query can exploit this vulnerability. The issue is fixed in version 7.1.0. This vulnerability has a CVSS score of 9.4, indicating criti [truncated]
ChurchCRM, an open-source church management system, is vulnerable to time-based SQL injection in versions prior to 7.1.0. The vulnerability exists due to improper input validation in the Reports/ConfirmReportEmail.php endpoint, specifically with the familyId parameter. This allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or manipulation. The vulnerability is [truncated]