CVE-2025-68275: fallo crítico en ChurchCRM CRM
ChurchCRM vulnerable to Stored XSS - Group name > Person Listing
Publicada el · Actualizada el
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 0.2%
probabilidad de explotación
0.2%top 90% de las CVE
explotación observada
noninguna fuente lo reporta
ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnerability on the pages `View Active People`, `View Inactive people`, and `View All People`. Version 6.5.3 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Productos afectados
ChurchCRM · CRMCVEs relacionadas — ChurchCRM CRM
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-62521CRITICALChurchCRM has unauthenticated RCE in its Install WizardEPSS 4.5%CVE-2024-39304HIGHChurchCRM SQL Injection VulnerabilityEPSS 3.0%CVE-2026-39339CRITICALChurchCRM has an API Authentication BypassEPSS 1.8%CVE-2025-68109CRITICALChurchCRM vulnerable to RCE with database restore functionalityEPSS 1.5%CVE-2026-39337CRITICALChurchCRM Affected by Unauthenticated RCE in Install WizardEPSS 1.1%CVE-2026-42288CRITICALChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORDEPSS 1.0%