CVE-2026-39341CWE-89

SQL injection in ChurchCRM.0

High · published April 7, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
33.9
In the wild
Unconfirmed
What it is

ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not used to create the SQL query. This vulnerability is fixed in 7.1.0.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00407 · 33.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-07T18:01Z
EPSS history
Timeline
  • 07 APR 18:01Z
    SQL injection in ChurchCRM.0
    cvelistv5