CVE-2026-39318
ChurchCRM is an open-source church management system.
Published Apr 7, 2026 · updated Jun 17, 2026 · churchcrm churchcrm
ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints , , and . A user has to be authenticated. For privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the parameter and thus modify tables from the database. This vulnerability is fixed in 7.1.0.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 7, 2026 · NIST NVD
Detected
ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints , , and . A user has to be authenticated. For privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the parameter and thus modify tables from the da
Jun 17, 2026 · NIST NVD
Updated
ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints , , and . A user has to be authenticated. For privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the parameter and thus modify tables from the da
Affected
- cpe churchcrm/churchcrmversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-39318
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-39318
ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints , , and . A user has to be authenticated. For
nvd.nist.gov