Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Versions prior to 7.1.0 have an SQL injection vulnerability in the endpoints `/GroupPropsFormRowOps.php`, `/PersonCustomFieldsRowOps.php`, and `/FamilyCustomFieldsRowOps.php`. A user has to be authenticated. For `ManageGroups` privileges have to be enabled and for the other two endpoints the attack has to be executed by an administrative user. These users can inject arbitrary SQL statements through the `Field` parameter and thus modify tables from the database. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39318 ChurchCRM is an open-source church management system. Prior to 7.1.0, the GroupPropsFormRowOps.php file contains a SQL injection vulnerability. User input in the Fiel… https://www.cve.org/CVERecord?id=CVE-2026-39318
Post summary
The tweet discloses a SQL injection vulnerability in ChurchCRM’s GroupPropsFormRowOps.php (pre‑7.1.0), with no PoC, exploit, or patch details provided.
[CVE-2026-39318: HIGH] ChurchCRM prior to 7.1.0 had a SQL injection vulnerability due to unsanitized input in GroupPropsFormRowOps.php. Update to the latest version to patch this issue.#cve,CVE-2026-39318,#cybersecurity https://cvefind.com/CVE-2026-39318
Post summary
The post announces a high-severity SQL injection in ChurchCRM versions before 7.1.0 and urges users to update to the latest version to patch the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |