SQL Injection Vulnerability in EcclesiaCRM Software for Church Management

CVE-2026-35184

What is CVE-2026-35184?

EcclesiaCRM, a popular church management software, contains a SQL injection vulnerability that affects versions prior to 8.0.0. This vulnerability is located in the v2/templates/query/queryview.php file due to improper handling of the custom and value parameters, potentially allowing malicious actors to execute arbitrary SQL queries. The issue was addressed in the release of version 8.0.0, which includes necessary security enhancements to protect users from potential data breaches.

References