CVE-2026-44418

High

Published: 13/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

EcclesiaCRM versions 8.0.0 and earlier have a vulnerability in the ValidateInput() function that passes user-supplied POST parameters directly into SQL queries without proper sanitization. This allows for SQL injection attacks through query parameters using non-standard validation types.

Risk Assessment

Organizations using EcclesiaCRM may be vulnerable to SQL injection attacks, potentially leading to unauthorized access and modification of data.

Recommendation

It is recommended to update EcclesiaCRM to the latest version to mitigate this vulnerability and implement proper input sanitization mechanisms.

Other vulnerabilities in EcclesiaCRM

CVE-2026-35184Critical
EcclesiaCRM prior to version 8.0.0 has a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters.

Original NVD description (English source)

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through query parameters that use non-standard validation types. This is caused by an incomplete fix for CVE-2026-35184.