Vulnerability Description
ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0.
Related Weaknesses (CWE)
References
- https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850
- https://github.com/ChurchCRM/CRM/pull/8607
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hc37-vx3w-34fg
FAQ
What is CVE-2026-40482?
CVE-2026-40482 is a documented vulnerability. ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $routeAndAccount concatenated into raw SQL...
How severe is CVE-2026-40482?
CVSS scoring is not yet available for CVE-2026-40482. Check NVD for updates.
Is there a patch for CVE-2026-40482?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.