SQL Injection Vulnerability in ChurchCRM Open-Source Management System
CVE-2026-35566

8.8HIGH

Key Information:

Vendor

Churchcrm

Status
Crm
Vendor
CVE Published:
7 April 2026

What is CVE-2026-35566?

ChurchCRM is an open-source church management system that contains an SQL injection vulnerability due to improper handling of user input. Specifically, in versions prior to 7.1.0, the vulnerability occurs in the 'src/Reports/FundRaiserStatement.php' file, where the '$_SESSION['iCurrentFundraiser']' input is used in an unquoted numeric SQL context without proper integer validation. This value is derived from 'src/FundRaiserEditor.php', where user input is filtered without specifying it as an 'int'. To mitigate this risk, users are advised to upgrade to version 7.1.0 or later.

Affected Version(s)

CRM < 7.1.0

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.