Stored Cross-Site Scripting in ChurchCRM Management System
CVE-2025-68399

2LOW

Key Information:

Vendor

Churchcrm

Status
Crm
Vendor
CVE Published:
17 December 2025

What is CVE-2025-68399?

ChurchCRM, an open-source church management system, has a Stored Cross-Site Scripting (XSS) vulnerability in the GroupEditor.php page. Users with permissions to view and modify groups can unintentionally execute malicious JavaScript when creating group roles, which could compromise the application security. This vulnerability is addressed in version 6.5.4. It is crucial for users operating earlier versions to update to ensure protection against potential exploits.

Affected Version(s)

CRM < 6.5.4

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA...
x_refsource_CONFIRM

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-68399 : Stored Cross-Site Scripting in ChurchCRM Management System