Published April 7, 2026 · Updated April 8, 2026
CVE-2026-39329 is a high-severity SQL injection vulnerability in ChurchCRM versions prior to 7.1.0. Authenticated users with AddEvent privileges can exploit this flaw through the newEvtTypeCntLst parameter, allowing them to manipulate SQL queries during event type creation. To mitigate this risk, upgrade to ChurchCRM version 7.1.0 or later immediately.
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was identified in /EventNames.php in ChurchCRM. Authenticated users with AddEvent privileges can inject SQL via the newEvtTypeCntLst parameter during event type creation. The vulnerable flow reaches an ON DUPLICATE KEY UPDATE clause where unescaped user input is interpolated directly. This vulnerability is fixed in 7.1.0.
CVE-2026-39329 is an SQL injection vulnerability in ChurchCRM versions prior to 7.1.0. Exploited via the newEvtTypeCntLst parameter, it allows authenticated users with AddEvent privileges to manipulate SQL queries. Upgrade to version 7.1.0 or later to mitigate.