CVE-2026-39343

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in the EditEventTypes.php file, which is only accessible to administrators. The ENtyid POST parameter is not sanitized before being used in a SQL query, allowing an administrator to execute...

PT-2025-51357

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.0 Description A SQL injection issue exists in the EventEditor.php file of ChurchCRM. The EN tyid POST parameter, used when creating a new event and selecting an event type, is not properly sanitized. This allows...

PT-2025-7492

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 5.13.0 and prior Description A time-based blind SQL Injection vulnerability exists in the EditEventAttendees.php file within the EN tyid parameter. The parameter is directly inserted into an SQL query without proper...

PT-2023-22441 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.5.4 Description: The issue concerns a Blind SQL Injection vulnerability, specifically time-based, affecting the /EditEventTypes.php endpoint through the EN tyid POST parameter. Recommendations: For ChurchCRM version 4.5.4,...

PT-2022-11518

Name of the Vulnerable Software and Affected Versions ChurchCRM versions 2.0.0 through 4.4.5 Description A SQL injection issue exists that allows an authenticated attacker to issue an arbitrary SQL command to the database through the unsanitized EN tyid, theID, and EID fields used when an Edit...