CVE-2026-39341

ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not used to create the SQL query. This vulnerability is fixed in 7.1.0.

• CWE-89

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-3h69-vjff-jj5cExploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-39336ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39337ChurchCRM is an open-source church management system. Prior …10
• CVE-2026-39338ChurchCRM is an open-source church management system. Prior …6.1
• CVE-2026-39339ChurchCRM is an open-source church management system. Prior …9.1
• CVE-2026-3934Insufficient policy enforcement in ChromeDriver in Google Ch…6.5
• CVE-2026-39340ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-39342ChurchCRM is an open-source church management system. Prior …8.8
• CVE-2026-39343ChurchCRM is an open-source church management system. Prior …7.2
• CVE-2026-39344ChurchCRM is an open-source church management system. Prior …8.1
• CVE-2026-39345OrangeHRM is a comprehensive human resource management (HRM)…4.9
• CVE-2026-39346OrangeHRM is a comprehensive human resource management (HRM)…5.4
• CVE-2026-39347OrangeHRM is a comprehensive human resource management (HRM)…2.7