CVE-2026-24854
Church CRM has SQL injection in PaddleNumEditor.php
Résumé
Church CRM has SQL injection in PaddleNumEditor.php
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint /PaddleNumEditor.php in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the PerID parameter. Version 6.7.2 contains a patch for the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com