churchcrm has 4 CVEs on record. The busiest recent month was December 2025 with 4. The median CVSS is 6.8 (medium), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-68109Critical· 9.1ChurchCRM is an open-source church management system62CVE-2025-67875Medium· 5.4ChurchCRM is an open-source church management system42CVE-2025-67751High· 7.2ChurchCRM is an open-source church management system40CVE-2025-67874Medium· 6.5ChurchCRM is an open-source church management system36
churchcrm vulnerabilities
CVEs affecting churchcrm, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2025-68109Critical· 9.1PoCChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file …
CVE-2025-67875Medium· 5.4PoCChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and C…
CVE-2025-67874Medium· 6.5ChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk o…
CVE-2025-67751High· 7.2ChurchCRM is an open-source church management system
ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not …