Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyTypeEditor.php in ChurchCRM. Authenticated users with the role isMenuOptionsEnabled can inject arbitrary SQL statements through the Name and Description parameters and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39326 ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyTypeEditor.php in ChurchCRM. A… https://www.cve.org/CVERecord?id=CVE-2026-39326
Post summary
The text announces the discovery of an SQL injection vulnerability in ChurchCRM before version 7.1.0, specifying the affected endpoint.
[CVE-2026-39326: HIGH] Critical SQL injection vulnerability in ChurchCRM fixed in version 7.1.0. Update now to protect against attacks through /PropertyTypeEditor.php endpoint. #CyberSecurity#cve,CVE-2026-39326,#cybersecurity https://cvefind.com/CVE-2026-39326
Post summary
The post alerts that a critical SQL injection flaw (CVE-2026-39326) in ChurchCRM’s PropertyTypeEditor.php endpoint has been fixed in version 7.1.0, urging users to update immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |