CVE-2026-39329

CVE-2026-39329 – ChurchCRM SQL injection : Affected: ChurchCRM prior to 7.1.0. Description: Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerability occurs in the ON DUPLICATE KEY UPDATE path where unescaped user ...