Search: CVE-2026-39337

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	10.0	EPSS 0.7%	CVE-2026-39337ChurchCRM CRM · Code Injection Critical10.0EPSS 0.7%2026-04-07CVE Database V5CVE-2026-39337 ChurchCRM is an open-source church management system. Prior to 7.1.0, critical pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard allows unauthenticated attackers to inject arbitrary PHP code during the initial installation process, leading to complete server compromise. The "$dbPassword" variable is not sanitized. This vulnerability exists due to an incomplete fix for CVE-2025-62521. This vulnerability is fixed in 7.1.0. EPSS 0.7%Vulnerability CWE-94	CVE Database V5	2026-04-07

Page 1 of 1