Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-39327. Reason: This candidate is a duplicate of CVE-2026-39327. Notes: All CVE users should reference CVE-2026-39327 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.another CVE.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
CVE-2026-35567 ChurchCRM is an open-source church management system. Prior to 7.1.0, the NewRole POST parameter in src/MemberRoleChange.php is used in an SQL query without proper in… https://www.cve.org/CVERecord?id=CVE-2026-35567
Post summary
The post reports that ChurchCRM versions prior to 7.1.0 contain an SQL injection flaw in src/MemberRoleChange.php via the NewRole POST parameter.
CVE-2026-35567 SQL Injection in ChurchCRM Prior to 7.1.0 via NewRole Parameter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-35567 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The tweet reports a SQL injection vulnerability (CVE-2026-35567) affecting ChurchCRM versions prior to 7.1.0, providing links to official vulnerability details.
[CVE-2026-35567: HIGH] Vulnerability alert in ChurchCRM open-source system: Prior to 7.1.0, authenticated users could inject arbitrary SQL. Update to version 7.1.0 for a fix. #cybersecurity#cve,CVE-2026-35567,#cybersecurity https://cvefind.com/CVE-2026-35567
Post summary
ChurchCRM users running versions prior to 7.1.0 are vulnerable to authenticated SQL injection; upgrading to 7.1.0 applies the necessary fix.