CVE-2026-35184

HighPublic PoC

Published: 06 April 2026

Published

06 April 2026

Modified

16 April 2026

KEV Added

—

Patch

—

CVSS Score v4 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0035 26.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-35184 is a high-severity SQL Injection (CWE-89) vulnerability in Ecclesiacrm Ecclesiacrm. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-35184 is a SQL injection vulnerability (CWE-89) in EcclesiaCRM, a CRM software for church management. The issue affects versions prior to 8.0.0 and is located in the file v2/templates/query/queryview.php, where the custom and value parameters fail to properly sanitize input. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its potential for severe impact.

A remote attacker requires no privileges or user interaction and can exploit the vulnerability over the network with low attack complexity. Successful exploitation grants high impacts on confidentiality, integrity, and availability, enabling arbitrary SQL query execution and likely full database compromise.

The vulnerability is addressed in EcclesiaCRM 8.0.0. Mitigation details appear in the GitHub security advisory (GHSA-gjw3-73q9-v2qh), pull request #2861, and the fixing commit f743b97f89da469a4c70b82bd61d0a59a3a957a9, with an additional analysis gist at https://gist.github.com/NicolasPauferro/d877992327592f1e8eb4e2c9dce1ae9b. Organizations should upgrade to version 8.0.0 immediately.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-19468

Vulnerability details

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SQL injection in public-facing web CRM app (queryview.php) allows unauthenticated remote arbitrary SQL execution and DB compromise, directly mapping to initial access via T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0