What’s Vulnerable › Vulnerabilities

CVE-2025-68112: ChurchCRM has SQL injection in EditEventAttendees.php

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-17 · updated 2026-06-17
• Weakness: CWE-89

Description

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows authenticated users to execute arbitrary SQL commands, leading to complete database compromise, administrative credential theft, and potential system takeover. The vulnerability enables attackers to extract sensitive member data, authentication credentials, and financial information from the church management system. Version 6.5.3 contains a patch for the issue.

Affected products

• ChurchCRM CRM: before 6.5.3 — fixed in 6.5.3

How to fix

Upgrade to a fixed version: ChurchCRM CRM 6.5.3. Check the vendor advisory for mitigations.

References

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-hxf4-3vhp-wqcq

Get alerted when CVE-2025-68112 or the next vulnerability affects your stack