ZeroDay Findings
Sign inSign up

Findings

CVE-2026-39319

ChurchCRM is an open-source church management system.

Published Apr 7, 2026 · updated Jun 17, 2026 · churchcrm churchcrm

ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 7, 2026 · NIST NVD

    Detected

    ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. T

  2. Jun 17, 2026 · NIST NVD

    Updated

    ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. T

Affected

  • cpe churchcrm/churchcrmversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-39319

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-39319

    ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL stat

    nvd.nist.gov

References