CVE-2026-39330Disclosure(churchcrm / churchcrm)

LOWCVSS 8.8 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch churchcrm churchcrm systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyAssign.php in ChurchCRM. Authenticated users with the role Manage Groups & Roles (ManageGroups) and Edit Records (isEditRecordsEnabled) can inject arbitrary SQL statements through the Value parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.

churchcrm CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

churchcrm

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Affected systems

Vendors

churchcrm

Products

churchcrm

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew184d
Disclosure
CVE-2026-39330 ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /PropertyAssign.php in ChurchCRM. Authe… https://www.cve.org/CVERecord?id=CVE-2026-39330
Post summary
The post discloses that CVE-2026-39330 is an SQL injection flaw in ChurchCRM’s /PropertyAssign.php endpoint on versions older than 7.1.0, but it provides no PoC, exploit, patch, or evidence of active exploitation.
0000093
57.0K followersView on X
CVEFind.com@CveFindCom184d
Patch
[CVE-2026-39330: HIGH] ChurchCRM, an open-source church management system, fixed an SQL injection vulnerability in version 7.1.0. Users could inject SQL statements through an endpoint, posing a security risk.#cve,CVE-2026-39330,#cybersecurity https://cvefind.com/CVE-2026-39330
Post summary
ChurchCRM has released a patch (v7.1.0) fixing a high‑severity SQL injection vulnerability (CVE-2026-39330), with no evidence of current exploitation.
0000037
619 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	churchcrm	churchcrm	-	-	-

Explore more

Back to dashboard churchcrm CVEs churchcrm vulnerabilities