Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /MemberRoleChange.php in ChurchCRM 7.0.5. Authenticated users with the role Manage Groups & Roles (ManageGroups) can inject arbitrary SQL statements through the NewRole parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39327 ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /MemberRoleChange.php in ChurchCRM 7.0.… https://www.cve.org/CVERecord?id=CVE-2026-39327
Post summary
The entry discloses an SQL injection flaw in ChurchCRM 7.0’s /MemberRoleChange.php that impacts releases before 7.1.0.
[CVE-2026-39327: HIGH] ChurchCRM, an open-source church management system, addressed a critical SQL injection flaw in version 7.1.0. Users with specific roles could exploit the issue to extract or alter data...#cve,CVE-2026-39327,#cybersecurity https://cvefind.com/CVE-2026-39327
Post summary
The post announces that ChurchCRM fixed a high‑severity SQL injection flaw in version 7.1.0, confirming a patch deployment without reporting active exploitation or providing exploit code.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |