Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39319 ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in Ch… https://www.cve.org/CVERecord?id=CVE-2026-39319
Post summary
The text reports the discovery of a second order SQL injection vulnerability (CVE-2026-39319) in ChurchCRM's /FundRaiserEditor.php endpoint, but provides no PoC, exploit code, or patch details.
[CVE-2026-39319: HIGH] Vulnerability alert: ChurchCRM versions before 7.1.0 were exposed to a second-order SQL injection flaw in /FundRaiserEditor.php. Ensure you've updated to the latest version for security.#cve,CVE-2026-39319,#cybersecurity https://cvefind.com/CVE-2026-39319
Post summary
The text announces a high‑severity second‑order SQL injection in ChurchCRM versions prior to 7.1.0 and urges users to update to the latest release for security.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |