About me

Summary

Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by an improper access check in the com_users batch task. Authenticated attackers could abuse the batch flow to escalate privileges.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-04-03 Reported to the Joomla Security Strike Team.
2. 2026-04-18 Confirmation of the issue and initial patch development.
3. 2026-05-26 Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

Summary

Joomla CMS 4.0.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by improper validation of order clauses in com_tags. Authenticated attackers could manipulate generated SQL and infer database contents through blind SQL injection.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-31 Reported to the Joomla Security Strike Team.
2. 2026-04-01 First acknowledgment.
3. 2026-04-11 Confirmation of the issue and initial patch development.
4. 2026-05-26 Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

Summary

Joomla CMS 5.4.0 through 5.4.5 and 6.0.0 through 6.1.0 were affected by improperly constructed filter clauses in the com_finder search query. Authenticated attackers could influence the SQL query and infer database contents through blind SQL injection.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-31 Reported to the Joomla Security Strike Team.
2. 2026-04-01 First acknowledgment.
3. 2026-04-11 Confirmation of the issue and initial patch development.
4. 2026-05-26 Fixed in Joomla CMS 5.4.6 and 6.1.1 and CVE assigned.

Summary

In ChurchCRM 7.0.5, settings input handled by SettingsIndividual.php could be used by an authenticated user to influence a SQL query. The issue enabled blind SQL injection behavior that could expose sensitive database contents.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-26 Report published to ChurchCRM and initial triage.
2. 2026-04-05 GitHub advisory published and CVE assigned.

Summary

In ChurchCRM 7.0.5, property assignment handling in PropertyAssign.php exposed a blind SQL injection path for authenticated users. Attackers could infer database contents and potentially alter application data through injected SQL.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-26 Report published to ChurchCRM and initial triage.
2. 2026-04-05 GitHub advisory published and CVE assigned.

Summary

In ChurchCRM 7.0.5, event-name management in EventNames.php exposed SQL injection behavior to authenticated users with access to the affected configuration path. Successful exploitation could expose or modify ChurchCRM database records.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-26 Report published to ChurchCRM and initial triage.
2. 2026-04-05 GitHub advisory published and CVE assigned.

Summary

In ChurchCRM 7.0.5, authenticated users with group and role management privileges could inject SQL through the MemberRoleChange.php role update flow. Depending on deployment configuration, this could provide database read/write access and potential privilege escalation.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-25 Report published to ChurchCRM and initial triage.
2. 2026-04-05 GitHub advisory published and CVE assigned.

Summary

In ChurchCRM 7.0.5, property type editing in PropertyTypeEditor.php accepted authenticated input that could influence SQL statements. The issue could lead to database compromise, including data extraction or modification.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-26 Report published to ChurchCRM and initial triage.
2. 2026-04-05 GitHub advisory published and CVE assigned.

Summary

In ChurchCRM 7.0.5, user settings handling in SettingsUser.php exposed an authenticated blind SQL injection path. Attackers could infer and extract database data through timing-based or boolean blind SQL techniques.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-26 Report published to ChurchCRM and initial triage.
2. 2026-04-05 GitHub advisory published and CVE assigned.

Summary

ChurchCRM 7.1.2 and earlier allowed stored input from FundRaiserEditor.php to become executable SQL later in the fundraiser workflow. This second-order SQL injection could lead to database compromise once the malicious stored value was processed.

References

• Repository
• Advisory source

Disclosure timeline

1. 2026-03-26 Report published to ChurchCRM and initial triage.
2. 2026-04-05 GitHub advisory published and CVE assigned.