Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-39329 ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated use… https://www.cve.org/CVERecord?id=CVE-2026-39329
Post summary
The post reports CVE‑2026‑39329 as an SQL injection vulnerability in ChurchCRM’s /EventNames.php (pre‑7.1.0), indicating the issue but offering no PoC, exploit, or patch details.
[CVE-2026-39329: HIGH] ChurchCRM 7.1.0 fixes a major SQL injection vulnerability, allowing authenticated users to inject SQL via EventNames.php. Update now to enhance cyber security.#cve,CVE-2026-39329,#cybersecurity https://cvefind.com/CVE-2026-39329
Post summary
ChurchCRM released version 7.1.0 that fixes a serious SQL injection vulnerability in EventNames.php, prompting users to update immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | churchcrm | churchcrm | - | - | - |