CVE-Katalog

CVE-2026-39319

ChurchCRM is an open-source church management system…

[CVE-Katalog]

ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

Schweregrad
High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.24% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "churchcrm",
      "ecosystem": "cpe",
      "fixed_version": "7.1.0",
      "provider_source": "nvd"
    },
    {
      "name": "churchcrm",
      "ranges": [
        {
          "fixed": "7.1.0",
          "introduced": "",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39319",
      "fixed_version": "7.1.0",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-39319",
      "provider_updated_at": "2026-10-25T23:10:00.167"
    }
  ]
}

OpenFactory catalog packages

Die Paketzuordnung läuft.

Beobachtet:

Referenzen

[FIRST EPSS] · [National Vulnerability Database (NVD)]