Stored Cross-Site Scripting Vulnerability in ChurchCRM by ChurchCRM
CVE-2025-68275

9.2CRITICAL

Key Information:

Vendor

Churchcrm

Status
Crm
Vendor
CVE Published:
17 December 2025

What is CVE-2025-68275?

ChurchCRM, an open-source church management system, is vulnerable to stored cross-site scripting attacks. This vulnerability affects various pages, including 'View Active People', 'View Inactive People', and 'View All People' in versions prior to 6.5.3. Attackers could exploit this vulnerability to inject malicious scripts, potentially compromising user data and leading to unauthorized actions within the application. Users are strongly encouraged to upgrade to version 6.5.3 or later to mitigate these risks.

Affected Version(s)

CRM < 6.5.3

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68275 : Stored Cross-Site Scripting Vulnerability in ChurchCRM by ChurchCRM