Churchcrm · Churchcrm · CVE-2026-39317
Name of the Vulnerable Software and Affected Versions
ChurchCRM versions prior to 7.1.0
Description
ChurchCRM, an open-source church management system, contains a SQL injection issue in its `SettingsIndividual.php` component. User-supplied data from the POST parameter, specifically array keys, is used directly in SQL queries without proper sanitization. This allows an authenticated user to extract sensitive data from the database.
Recommendations
Update to version 7.1.0 or later.