https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T10:50:55.191897+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-39319 CVE-2026-39319 — ChurchCRM has a Second Order SQLI via FundRaiserEditor.php 2026-10-17T10:50:55.213441+00:00

Affected: ChurchCRM CRM

ChurchCRM is an open-source church management system. Prior to 7.1.0, a second order SQL injection vulnerability was found in the endpoint /FundRaiserEditor.php in ChurchCRM. A user has to be authenticated but doesn't need any privileges. These users can inject arbitrary SQL statements through the iCurrentFundraiser PHP session parameter and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.