HarborGuard / CVE
Back to search
CRITICALCVE-2026-39342Published Modified CNA GitHub_M

CVE-2026-39342: ChurchCRM has a SQL injection searchwhat parameter via QueryView.php

ChurchCRM is an open-source church management system. Prior to 7.1.0, the searchwhat parameter via QueryView.php with the QueryID=15 is vulnerable to a SQL injection. The authenticated user requires access to Data/Reports > Query Menu and access to the "Advanced Search" query. This vulnerability is fixed in 7.1.0.

Metrics

CVSS v4.0
9.4
Severity
CRITICAL
Fixed in
—
Affected Products
1
Affected packages
  • ChurchCRM / CRM
    < 7.1.0
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References