Privilege Escalation and XSS Vulnerability in ChurchCRM by ChurchCRM

CVE-2025-67875

What is CVE-2025-67875?

ChurchCRM, an open-source church management system, has a vulnerability that allows an authenticated user with mid-level permissions to inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. This occurs when users with 'Edit Records' and 'Manage Properties and Classifications' permissions exploit an Insecure Direct Object Reference (IDOR) that permits viewing other users' profiles. When administrators load their profile page, the injected payload executes, leading to potential session hijacking and full account takeover. The risk has been addressed in version 6.5.3.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References