CVE-2026-24854

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor.php` in ChurchCRM prior to version 6.7.2. Any authenticated user, including one with zero assigned permissions, can exploit SQL injection through the `PerID` parameter. Version 6.7.2 contains a patch for the issue.

• CWE-89

• http://github.com/ChurchCRM/CRM/commit/748f5084fc06c5e12463dc7fdd62d1d31fc08d38Patch
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p3q7-q68q-h2grExploit, Vendor Advisory

Published

Jan 30, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24849OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-2485IBM Infosphere Information Server 11.7.0.0 through 11.7.1.6 …4.8
• CVE-2026-24850The ML-DSA crate is a Rust implementation of the Module-Latt…5.3
• CVE-2026-24851OpenFGA is a high-performance and flexible authorization/per…8.8
• CVE-2026-24852iccDEV provides a set of libraries and tools that allow for …8.1
• CVE-2026-24853Caido is a web security auditing toolkit. Prior to 0.55.0, C…9.8
• CVE-2026-24855ChurchCRM is an open-source church management system. Versio…5.4
• CVE-2026-24856iccDEV provides a set of libraries and tools that allow for …7.8
• CVE-2026-24857`bulk_extractor` is a digital forensics exploitation tool. S…9.8
• CVE-2026-24858An Authentication Bypass Using an Alternate Path or Channel …9.8
• CVE-2026-24859Rejected reason: Not used
• CVE-2026-2486The Master Addons For Elementor plugin for WordPress is vuln…6.4