PT-2026-40810 · Unknown · Ecclesiacrm

Published 2026-05-13 · Updated 2026-05-13 · CVE-2026-44418

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions EcclesiaCRM versions 8.0.0 and earlier

Description The ValidateInput() function's default case in the query view passes user-supplied POST parameters directly into SQL queries using str replace without proper sanitization. This allows for SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution, specifically through query parameters that utilize non-standard validation types.

Recommendations Update EcclesiaCRM to a version later than 8.0.0. As a temporary workaround, restrict access to the query view or avoid using non-standard validation types in query parameters until a patch is applied.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-44418

Affected Products

Ecclesiacrm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44418 · Security Note
• https://github.com/phili67/ecclesiacrm/security/advisories/GHSA-vmgq-gpf9-mjjj · Note
• https://github.com/phili67/ecclesiacrm/commit/f743b97f89da469a4c70b82bd61d0a59a3a957a9 · Note
• https://twitter.com/CVEnew/status/2054709204636889133 · Twitter Post