What’s Vulnerable › Vulnerabilities

CVE-2026-39329: ChurchCRM has a Blind SQL injection in EventNames.php

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-07 · updated 2026-10-26
• Weakness: CWE-89

Description

ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0.

Affected products

• ChurchCRM CRM: before 7.1.0 — fixed in 7.1.0

How to fix

Upgrade to a fixed version: ChurchCRM CRM 7.1.0. Check the vendor advisory for mitigations.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93g
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93g

Get alerted when CVE-2026-39329 or the next vulnerability affects your stack