CVE-2025-67877: high-severity vulnerability in ChurchCRM CRM
ChurchCRM SQL Injection Vulnerability
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.4epss 0.4%
exploitation probability
0.4%top 71% of all CVEs
observed exploitation
nono source reports it
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifically in how the `PersonAddress` POST parameter is handled. Unlike other parameters in the same file which are correctly cast to integers using the `InputUtils` class, the `PersonAddress` parameter is missing the type definition. This allows an attacker to inject arbitrary SQL commands directly into the query. Version 6.5.3 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
ChurchCRM · CRMRelated CVEs — ChurchCRM CRM
In the same product, most dangerous first.
CVE-2025-62521CRITICALChurchCRM has unauthenticated RCE in its Install WizardEPSS 4.5%CVE-2024-39304HIGHChurchCRM SQL Injection VulnerabilityEPSS 3.0%CVE-2026-39339CRITICALChurchCRM has an API Authentication BypassEPSS 1.8%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.5%CVE-2026-39337CRITICALChurchCRM Affected by Unauthenticated RCE in Install WizardEPSS 1.1%CVE-2026-42288CRITICALChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORDEPSS 1.0%