Vulnerabilities

Report: CVE-2026-40482 - ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanS

2026-04-18 0 views admin

CVE ID :CVE-2026-40482 Published : April 18, 2026, 12:16 a.m. | 1 hour, 15 minutes ago Description :ChurchCRM is an open-source church management system. Versions prior to 7.2.0 have SQL injection in FinancialService::getMemberByScanString() via unsanitized $routeAndAccount concatenated into raw SQL. This issue has been fixed in version 7.2.0. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE Details

CVE ID

CVE-2026-40482

Severity

HIGH

Published

April 18, 2026

Impact: SQL injection

🏷️ Tags

report40482churchcrmauthenticatedinjectionfamiliesbychecknumberscanscvesql injection

InfinitSec - Latest Cybersecurity, Technology & Gaming News

Report: CVE-2026-40482 - ChurchCRM has Authenticated SQL Injection in `/api/families/byCheckNumber/{scanS

CVE Details

🏷️ Tags

More from Vulnerabilities

Report: CVE-2026-40337 - Sentry kernel has incomplete ownership check for IRQ line manipulation

Report: CVE-2026-40336 - libgphoto2 has memory leak in ptp_unpack_Sony_DPD() secondary enumeration list i

Report: CVE-2026-40335 - libgphoto2 has OOB read in ptp_unpack_DPV() UINT128/INT128 handling in ptp-pack.c - Guide

Report: CVE-2026-40333 - libgphoto2 has OOB read in ptp_unpack_EOS_ImageFormat() and ptp_unpack_EOS_Custo

Trending

CVE-2025-61481: Critical Remote Code Execution Vulnerability in MikroTik RouterOS & SwitchOS

CVE-2025-43939: Dell Unity OS Command Injection (High)

Google disputes false claims of massive Gmail data breach

Microsoft: DNS outage impacts Azure and Microsoft 365 services

3.5B Accounts, 1 Critical Flaw: Meta Closes WhatsApp Data-Harvesting