phili67 vulnerabilities

Products

• ecclesiacrm 2
• Ecclesia CRM 1

Latest phili67 CVEs

Newest publication first

1. CVE-2026-44418 Incomplete fix for CVE-2026-35184: SQL Injection in phili67/ecclesiacrm

   Published 2026-05-13

   High·CVSS 8.7 EPSS 0.29%

   EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parameters directly into SQL queries via str_replace without any sanitization, enabling SQL injection through...

2. CVE-2026-6628 phili67 Ecclesia CRM Query Viewer view ValidateInput sql injection

   Published 2026-04-20

   Medium·CVSS 5.3 EPSS 0.20%

   A flaw has been found in phili67 Ecclesia CRM up to 8.0.0. This affects the function ValidateInput of the file /v2/query/view/ of the component Query Viewer Component. This manipulation of the argument custom causes sql injection. The attack can be initiated remotely. The exploit...

3. CVE-2026-35184 EcclesiaCRM has a Critical SQL Injection

   Published 2026-04-06

   High·CVSS 8.7 EPSS 0.36%

   EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.