CVE-2023-24685: Churchcrm

High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days.

ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance reports module.

Affected products

• Churchcrm Churchcrm: up to and including 4.5.3

Published 2023-02-09. Last modified 2026-06-17.