CVE-2026-35566 | ChurchCRM up to 7.0.x FundRaiserStatement.php legacyFilterInputArr iCurrentFundraiser sql injection

A vulnerability was found in ChurchCRM up to 7.0.x. It has been declared as critical. The impacted element is the function InputUtils::legacyFilterInputArr of the file src/Reports/FundRaiserStatement.php. Such manipulation of the argument iCurrentFundraiser leads to sql injection.

This vulnerability is uniquely identified as CVE-2026-35566. The attack can be launched remotely. No exploit exists.

It is recommended to upgrade the affected component.