PT-2026-30964 · Churchcrm · Crm
Loociprian
·
Published
2026-04-07
·
Updated
2026-04-07
·
CVE-2026-39341
CVSS v3.1
8.1
High
| AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
ChurchCRM is an open-source church management system. Prior to 7.1.0, The application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not used to create the SQL query. This vulnerability is fixed in 7.1.0.
Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Crm