| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-6628 | phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection | phili67 | Ecclesia CRM | Medium | 6.3 | 2026-04-20 10:00:17 | Deep Dive |
| CVE-2026-40593 | ChurchCRM: Stored XSS in UserEditor.php via Login Name Field | ChurchCRM | CRM | Medium | 4.8 | 2026-04-18 00:03:00 | Deep Dive |
| CVE-2026-40581 | ChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion | ChurchCRM | CRM | High | 8.1 | 2026-04-17 23:51:33 | Deep Dive |
| CVE-2026-40485 | ChurchCRM: Username Enumeration via Differential Response in Public Login API | ChurchCRM | CRM | Medium | 5.3 | 2026-04-17 23:29:36 | Deep Dive |
| CVE-2026-40484 | ChurchCRM: Authenticated Remote Code Execution via Unrestricted PHP File Write in Database Restore Function | ChurchCRM | CRM | Critical | 9.1 | 2026-04-17 23:25:06 | Deep Dive |
| CVE-2026-40483 | ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field | ChurchCRM | CRM | Medium | 5.4 | 2026-04-17 23:20:45 | Deep Dive |
| CVE-2026-40582 | ChurchCRM: Authentication Bypass in `/api/public/user/login` Allows Bypass of 2FA and Account Lockout | ChurchCRM | CRM | - | - | 2026-04-17 23:16:14 | Deep Dive |
| CVE-2026-40480 | ChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}` | ChurchCRM | CRM | - | - | 2026-04-17 23:07:30 | Deep Dive |
| CVE-2026-40482 | ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanString}` | ChurchCRM | CRM | - | - | 2026-04-17 22:58:49 | Deep Dive |
| CVE-2026-39940 | ChurchCRM has an Open Redirect via the ‘linkBack’ URL Parameter in DonatedItemEditor.php | ChurchCRM | CRM | 中危 | - | 2026-04-13 16:34:58 | Deep Dive |
| CVE-2019-25710 | Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter | Dolibarr | Dolibarr ERP-CRM | High | 8.2 | 2026-04-12 12:28:55 | Deep Dive |
| CVE-2026-31845 | Rukovoditel CRM 安全漏洞 | Rukovoditel | Rukovoditel CRM | Critical | 9.3 | 2026-04-11 18:26:46 | Deep Dive |
| CVE-2026-39941 | ChurchCRM has an XSS vulnerability | ChurchCRM | CRM | - | - | 2026-04-09 15:38:07 | Deep Dive |
| CVE-2026-39337 | ChurchCRM Affected by Unauthenticated RCE in Install Wizard | ChurchCRM | CRM | Critical | 10.0 | 2026-04-07 18:08:27 | Deep Dive |
| CVE-2026-39319 | ChurchCRM has a Second Order SQLI via FundRaiserEditor.php | ChurchCRM | CRM | High | 8.8 | 2026-04-07 18:05:18 | Deep Dive |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | ChurchCRM | CRM | - | - | 2026-04-07 18:04:24 | Deep Dive |
| CVE-2026-39343 | ChurchCRM has a SQL Injection in Event Type Editor (Admin) | ChurchCRM | CRM | High | 7.2 | 2026-04-07 18:03:25 | Deep Dive |
| CVE-2026-39342 | ChurchCRM has a SQL injection searchwhat parameter via QueryView.php | ChurchCRM | CRM | - | - | 2026-04-07 18:02:40 | Deep Dive |
| CVE-2026-39341 | SQL injection in ChurchCRM.0 | ChurchCRM | CRM | High | 8.1 | 2026-04-07 18:01:42 | Deep Dive |
| CVE-2026-39340 | ChurchCRM has a SQL Injection in PropertyTypeEditor.php via Incorrect Sanitizer Substitution | ChurchCRM | CRM | High | 8.1 | 2026-04-07 18:00:09 | Deep Dive |