CVE-2026-35184

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35184
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35184.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35184
Aliases
  • GHSA-gjw3-73q9-v2qh
Published
2026-04-06T19:21:22Z
Modified
2026-10-28T02:30:57Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
EcclesiaCRM has a Critical SQL Injection
Details

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35184.json"
}
References

Affected packages

Git / github.com/phili67/ecclesiacrm

Affected ranges

Type
GIT
Repo
https://github.com/phili67/ecclesiacrm
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b87cb0e4aa739a47b2532ac9f12542f6d14231e4
Fixed
f743b97f89da469a4c70b82bd61d0a59a3a957a9
Database specific
Show details 
{
    "extracted_events": [
        {
            "cpe": "cpe:2.3:a:ecclesiacrm:ecclesiacrm:*:*:*:*:*:*:*:*",
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "8.0.0"
                }
            ],
            "source": "CPE_RANGE"
        },
        {
            "range": [
                {
                    "fixed": "f743b97f89da469a4c70b82bd61d0a59a3a957a9"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.0-RC2
2.0.1
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2
2.6.3
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.8.0
2.8.0-RC1
2.8.0-RC2
2.8.1
2.8.10
2.8.11
2.8.12
2.8.13
2.8.14
2.8.15
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.9
3.*
3.0.0
3.1.0
3.2.0
3.2.1
3.3.0
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.5.0
3.6.0
3.6.1
3.6.2
4.*
4.0.0
4.1.0
4.2.0
4.3.0
4.3.1
4.4.0
4.4.1
4.4.2
4.5.0
4.5.1
4.5.2
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.7.3
4.7.4
4.7.5
4.7.6
4.8.0
4.9.0
4.9.1
4.9.2
5.*
5.0.0
5.1.0
5.2.0
5.3.0
5.3.1
5.4.0
5.4.1
5.4.2
5.4.3
5.5.0
5.5.1
5.5.2
5.5.3
5.5.4
5.5.5
5.5.6
5.6.0
5.6.1
5.6.2
5.7.0
5.8.0
5.8.1
5.8.2
5.8.3
5.8.4
5.8.5
5.8.6
6.*
6.0.0
6.0.1
7.*
7.0.0
7.5.0
7.6.1
Other
untagged-0e6e5655727964439a56

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35184.json"