churchcrm vulnerabilities
CVEs whose affected-version data names the churchcrm package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2025-68109Critical· 9.1PoCChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file …
CVE-2025-67875Medium· 5.4PoCChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and C…
CVE-2025-67874Medium· 6.5ChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk o…
CVE-2025-67751High· 7.2ChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not …