Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDelete.php causes a logged-in ChurchCRM user with the relevant role to silently delete records, including cascaded property and record-to-property assignments. This vulnerability is fixed in 7.3.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-05-12 | 1 | Disclosure1 |
| 2026-05-13 | 1 | General1 |
CVE-2026-44548 Cross-Site Request Forgery in ChurchCRM Prior to Version 7.3.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44548
Post summary
The text lists CVE-2026-44548 as a CSRF vulnerability against ChurchCRM versions older than 7.3.2, without providing exploit code, active‑use evidence, or mitigation guidance.
CVE-2026-44548 ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, Pr… https://www.cve.org/CVERecord?id=CVE-2026-44548
Post summary
The advisory highlights a cross‑site GET navigation vulnerability in ChurchCRM before version 7.3.2, which is remedied in 7.3.2.