CVE-2026-39319CWE-89

ChurchCRM has a Second Order SQLI via FundRaiserEditor.php

High · published April 7, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
36.7
In the wild
Unconfirmed
What it is

ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00435 · 36.7th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-07T18:05Z
EPSS history
Timeline
  • 07 APR 18:05Z
    ChurchCRM has a Second Order SQLI via FundRaiserEditor.php
    cvelistv5