SQL Injection in Churchcrm Crm
CVE-2026-40482
ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version…
Vulnerability class: SQL Injection
EPSS: 0.000 (1.8th percentile) — read the EPSS interpretation.
Affected products
- Churchcrm Crm — versions < 7.2.0
Weakness classification (CWE)
References
- https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hc37-vx3w-34fg (x_refsource_CONFIRM)
- https://github.com/ChurchCRM/CRM/pull/8607 (x_refsource_MISC)
- https://github.com/ChurchCRM/CRM/commit/214694eb83778e1f5e52b3dfa2a99d0e965c1850 (x_refsource_MISC)