CVE-2026-39340

ChurchCRM is an open-source church management system. Prior to 7.1.0, a SQL injection vulnerability exists in PropertyTypeEditor.php, part of the administration functionality for managing property type categories (People → Person Properties / Family Properties). The vulnerability was introduced when legacyFilterInput() which both strips HTML and escapes SQL — was replaced with sanitizeText(), which strips HTML only. User-supplied values from the Name and Description fields are concatenated directly into raw INSERT and UPDATE queries with no SQL escaping. This allows any authenticated user with the MenuOptions role (a non-admin staff permission) to perform time-based blind injection and exfiltrate any data from the database, including password hashes of all users. This vulnerability is fixed in 7.1.0.

• CWE-89

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66f7-4p96-mww9Third Party Advisory
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-66f7-4p96-mww9Third Party Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39335ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39336ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39337ChurchCRM is an open-source church management system. Prior …10
• CVE-2026-39338ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39339ChurchCRM is an open-source church management system. Prior …9.1
• CVE-2026-3934Insufficient policy enforcement in ChromeDriver in Google Ch…6.5
• CVE-2026-39341ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-39342ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-39343ChurchCRM is an open-source church management system. Prior …7.2
• CVE-2026-39344ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-39345OrangeHRM is a comprehensive human resource management (HRM)…4.9
• CVE-2026-39346OrangeHRM is a comprehensive human resource management (HRM)…5.4