CVE-2026-35184

CRITICAL

EcclesiaCRM has a Critical SQL Injection

Title source: cna

Description

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.

References (4)

Scores

CVSS v3 9.8
EPSS 0.0003
EPSS Percentile 8.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (2)
ecclesiacrm/ecclesiacrm < 8.0.0
phili67/ecclesiacrm < 8.0.0
Published Apr 06, 2026
Tracked Since Apr 07, 2026