phili67/ecclesiacrm

phili67/ecclesiacrm

www.ecclesiacrm.com

Releases155

Frequency3 weeks 2 days

Last Release 6 months ago

Stars61

A CRM Software for church management.

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-44418 ↗	May 13, 2026Wednesday, 13 May 2026, 21:16	—	—
EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.
CVE-2026-35184 ↗	Apr 6, 2026Monday, 6 April 2026, 20:16	9.8 CRITICAL	—
EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.