Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the `PerID` parameter. Version 6.7.2 contains a patch for the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-30 | 3 | Disclosure2Patch1 |
| 2026-01-31 | 1 | Patch1 |
A high-severity SQL injection flaw (CVE-2026-24854) affects Church CRM's PaddleNumEditor.php. This can lead to database compromise. Review fixes and apply updates. #SQLi #ChurchCRM #infosec https://www.pulsepatch.io/posts/cve-2026-24854-church-crm-sql-injection
Post summary
A high‑severity SQL injection vulnerability (CVE‑2026‑24854) in Church CRM’s PaddleNumEditor.php can compromise the database; patching is recommended.
CVE-2026-24854 SQL Injection in ChurchCRM Prior to 6.7.2 via Authenticated `/Pad... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-24854 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
Announces CVE‑2026‑24854 as a SQL injection in ChurchCRM prior to version 6.7.2, providing a link for more details, with no exploit or patch information included.
[CVE-2026-24854: HIGH] Critical SQL Injection vulnerability in ChurchCRM prior to version 6.7.2 allows any authenticated user to exploit it through the `PerID` parameter. Update to version 6.7.2 for security.#cve,CVE-2026-24854,#cybersecurity https://cvefind.com/CVE-2026-24854
Post summary
The advisory announces a critical SQL injection in ChurchCRM that any authenticated user can exploit via the PerID parameter and advises upgrading to v6.7.2.
CVE-2026-24854 ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any… https://www.cve.org/CVERecord?id=CVE-2026-24854
Post summary
The post discloses a SQL injection flaw in ChurchCRM (CVE-2026-24854) affecting versions before 6.7.2, but it contains no exploit code, patch details, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |