CVE-2026-35184

CriticalCVSS 9.8

Published: 06/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

28th percentile - higher than 28% of all known CVEs

Summary

EcclesiaCRM prior to version 8.0.0 has a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters.

Risk Assessment

An attacker can inject malicious SQL queries, potentially leading to data leakage or modification.

Recommendation

Update EcclesiaCRM to version 8.0.0 or later, which includes a fix for the SQL injection vulnerability.

Original NVD description (English source)

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.