CVE-2026-34402
HIGH
NVD
CVSS Score
8.1
Severity
HIGH
Published
Apr 06, 2026
Vendor
unknown
Description
ChurchCRM is an open-source church management system. Prior to 7.1.0, authenticated users with Edit Records or Manage Groups permissions can exploit a time-based blind SQL injection vulnerability in the PropertyAssign.php endpoint to exfiltrate or modify any database content, including user credentials, personal identifiable information (PII), and configuration secrets. This vulnerability is fixed in 7.1.0.