PT-2026-30660 · Churchcrm · Crm

Sh4Dowalker · Publicado 2026-04-06 · Atualizado 2026-04-06 · CVE-2026-34402

Mitre

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

ChurchCRM is an open-source church management system. Prior to 7.1.0, authenticated users with Edit Records or Manage Groups permissions can exploit a time-based blind SQL injection vulnerability in the PropertyAssign.php endpoint to exfiltrate or modify any database content, including user credentials, personal identifiable information (PII), and configuration secrets. This vulnerability is fixed in 7.1.0.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-34402

Produtos afetados

Crm

Referências · 2

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-r57q-r5v3-v5h8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-34402 · Nota de Segurança