CVE-2026-44418CWE-89

Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm

High · published May 13, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00358 · 28.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-05-13T20:58Z
EPSS history
Timeline
  • 13 MAY 20:58Z
    Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm
    cvelistv5