CVE-2026-42288: Churchcrm CRM

Critical severity, CVSS 10.0. EPSS: 1% chance of exploitation in the next 30 days.

ChurchCRM is an open-source church management system. Prior to 7.3.2, The fix for CVE-2026-39337 is incomplete. The pre-authentication remote code execution vulnerability in ChurchCRM's setup wizard via unsanitized DB_PASSWORD remains fully exploitable This vulnerability is fixed in 7.3.2.

Affected products

• Churchcrm CRM: before 7.3.2 (fixed in 7.3.2)

Published 2026-05-12. Last modified 2026-06-17.