Vulnerability Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Churchcrm | Churchcrm | < 7.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93gThird Party Advisory
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-ggfm-5q4w-p93gThird Party Advisory
FAQ
What is CVE-2026-39329?
CVE-2026-39329 is a vulnerability with a CVSS score of 8.8 (HIGH). ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can in...
How severe is CVE-2026-39329?
CVE-2026-39329 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-39329?
Check the references section above for vendor advisories and patch information. Affected products include: Churchcrm Churchcrm.