---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: Prior to 7.3.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ChurchCRM is vulnerable to pre-authentication remote code execution via an unsanitized database password in the setup wizard.

Executive Summary:
An incomplete fix for a critical pre-authentication remote code execution vulnerability in ChurchCRM allows unauthenticated attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-42288

Affected Software: ChurchCRM

Affected Versions: Prior to 7.3.2

Vulnerability: This is a pre-authentication remote code execution vulnerability occurring in the setup wizard, caused by improper sanitization of the DB_PASSWORD field; it represents an incomplete fix for CVE-2026-39337.

Business Impact

With a CVSS score of 10, this vulnerability is of the highest severity, enabling an unauthenticated attacker to execute arbitrary code on the underlying server. Successful exploitation could lead to total system compromise, including the theft of sensitive congregant data, unauthorized modification of records, and the use of the server as a pivot point for further network attacks.

Remediation Plan

Immediate Action: Upgrade all instances of ChurchCRM to version 7.3.2 or later immediately to resolve the incomplete patch.

Proactive Monitoring: Monitor server logs for suspicious process execution or unauthorized attempts to access the setup wizard or database configuration files.

Compensating Controls: If an immediate update is not possible, restrict access to the web interface to trusted IP addresses using a Web Application Firewall (WAF) or network ACLs.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of May 12, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of the flaw as an incomplete patch for a critical RCE makes it a highly attractive target for attackers.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it provides a direct path to remote code execution without requiring authentication. Administrators must treat this as a high-priority remediation task and deploy version 7.3.2 without delay.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 6.7.2
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p3q7-q68q-h2gr","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p3q7-q68q-h2gr","tags":["x_refsource_CONFIRM"]},{"url":"http://github.com/ChurchCRM/CRM/commit/748f5084fc06c5e12463dc7fdd62d1d31fc08d38","name":"http://github.com/ChurchCRM/CRM/commit/748f5084fc06c5e12463dc7fdd62d1d31fc08d38","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T19:15:02.050Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the /PaddleNumEditor.php endpoint allows any authenticated user to execute arbitrary SQL commands via the PerID parameter.

Executive Summary:
A critical SQL injection vulnerability in ChurchCRM allows authenticated users to compromise the database and gain full control over application data.

Vulnerability Details

CVE-ID: CVE-2026-24854

Affected Software: ChurchCRM CRM

Affected Versions: < 6.7.2

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /PaddleNumEditor.php endpoint. Any authenticated user, regardless of their assigned permission level, can manipulate the PerID parameter to execute unauthorized database commands.

Business Impact

The ability to perform SQL injection allows an attacker to bypass security controls, extract sensitive member data, modify records, or potentially gain administrative access to the underlying server. With a CVSS score of 8.8, this vulnerability poses a high risk to the confidentiality, integrity, and availability of church management records, which often contain personally identifiable information.

Remediation Plan

Immediate Action: Update ChurchCRM to version 6.7.2 or later to apply the official vendor patch.

Proactive Monitoring: Review application access logs for unusual requests targeting the /PaddleNumEditor.php file, particularly those containing SQL syntax characters like single quotes or semicolons.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block malicious SQL injection patterns in the PerID parameter for the affected endpoint until the update can be deployed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of February 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of necessary privilege requirements beyond basic authentication.

Analyst Recommendation

Given the high CVSS severity and the existence of a proof-of-concept, organizations using ChurchCRM should prioritize this update immediately. Ensure that all users, even those with limited roles, are monitored, as the flaw is exploitable by any authenticated account. Applying the patch to version 6.7.2 is the only definitive way to remediate this security risk.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 6.5.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v54g-2pvg-gvp2","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-v54g-2pvg-gvp2","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:42.986Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the legacy endpoint /Reports/ConfirmReportEmail.php of ChurchCRM, allowing unauthenticated attackers to execute arbitrary SQL commands via the familyId parameter.

Executive Summary:
A critical SQL injection vulnerability in ChurchCRM allows unauthenticated attackers to compromise database integrity and gain unauthorized access to sensitive information.

Vulnerability Details

CVE-ID: CVE-2025-68400

Affected Software: ChurchCRM CRM

Affected Versions: < 6.5.3

Vulnerability: This vulnerability is caused by improper neutralization of special elements used in an SQL command (CWE-89) within the legacy /Reports/ConfirmReportEmail.php endpoint. Despite the feature being removed from the user interface, the file remains reachable and exploitable by an unauthenticated attacker via the familyId parameter.

Business Impact

The ability to perform SQL injection poses a severe risk to data confidentiality, integrity, and availability. An attacker can leverage this flaw to extract sensitive member information, modify database contents, or potentially gain full control over the application backend, leading to significant reputational damage and operational disruption. The CVSS score of 8.8 reflects the high severity of this vulnerability, particularly given that it does not require authentication to exploit.

Remediation Plan

Immediate Action: Update ChurchCRM to version 6.5.3 or later immediately to remove the vulnerable code path.

Proactive Monitoring: Review web server access logs for anomalous requests targeting the /Reports/ConfirmReportEmail.php endpoint and monitor database query logs for suspicious SQL patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the specified parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/lukasz-rybak/CVE-2025-68400).

Analyst Notes: As of December 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the presence of reachable, unprotected code.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents an urgent risk to ChurchCRM deployments. Administrators must prioritize updating to version 6.5.3 to eliminate the legacy code and secure the application against potential data breaches.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 6.5.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c4vm-87vf-hmx9","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c4vm-87vf-hmx9","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:43.014Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the ChurchCRM ReImport functionality allows authenticated users with finance privileges to execute arbitrary SQL queries via the MissingEgive_FamID_ parameter.

Executive Summary:
ChurchCRM is affected by a SQL injection vulnerability that allows authenticated users with specific privileges to compromise the underlying database, posing a high risk of unauthorized data manipulation.

Vulnerability Details

CVE-ID: CVE-2025-68111

Affected Software: ChurchCRM CRM

Affected Versions: < 6.5.3

Vulnerability: This is a SQL injection flaw (CWE-89) located in the eGive.php script. The vulnerability permits an authenticated user with finance-level privileges to inject malicious SQL commands through the MissingEgive_FamID_ POST parameter.

Business Impact

Successful exploitation of this vulnerability allows an attacker to bypass standard database controls, leading to unauthorized data access, modification, or complete deletion of records. Given the CVSS score of 7.2, this represents a significant risk to the integrity and confidentiality of sensitive church management data, which may include donor information or financial records.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later, as this release contains the necessary security patch to neutralize the vulnerable parameter.

Proactive Monitoring: Review web server and application logs for suspicious POST requests containing unexpected SQL syntax or unusual activity directed at the eGive.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect incoming POST parameters and block requests containing common SQL injection patterns until the update can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 18, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the ability to interact directly with the backend database.

Analyst Recommendation

The presence of a known SQL injection vulnerability in a management system necessitates immediate patching to prevent potential data breaches. Security administrators must prioritize upgrading to version 6.5.3 to eliminate the attack vector and ensure the continued integrity of the application environment.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 6.5.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-h3vq-9gr6-h9r4","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-h3vq-9gr6-h9r4","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:42.986Z
---END_METADATA---

Description Summary:
ChurchCRM versions prior to 6.5.3 contain a SQL injection vulnerability in the PersonAddress parameter within src/CartToFamily.php, allowing authenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A high-severity SQL injection vulnerability in ChurchCRM versions prior to 6.5.3 allows authenticated attackers to execute unauthorized database commands, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2025-67877

Affected Software: ChurchCRM CRM

Affected Versions: < 6.5.3

Vulnerability: The application fails to properly sanitize the PersonAddress POST parameter in the src/CartToFamily.php file. This allows an authenticated attacker to inject malicious SQL statements, as the input is not cast to an integer like other parameters in the same file.

Business Impact

Successful exploitation of this SQL injection vulnerability could lead to unauthorized access to sensitive church management data, including member information and financial records. Given the CVSS score of 8.8, this flaw represents a significant risk, as it grants attackers the ability to manipulate the underlying database, potentially leading to full compromise of the application data.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Review web server and application access logs for unusual POST requests targeting the src/CartToFamily.php endpoint, particularly those containing SQL syntax characters.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP request parameters.

Exploitation Status

Public Exploit Available: No — there is no confirmation of a public weaponized exploit or published Proof of Concept.

Analyst Notes: As of December 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from a simple lack of input validation on a specific parameter, making it highly susceptible to automated scanning and exploitation.

Analyst Recommendation

Organizations utilizing ChurchCRM must prioritize the update to version 6.5.3 immediately to remediate this SQL injection flaw. Failure to patch allows authenticated users to bypass security controls and access the backend database, which may result in severe data breaches. Ensure that administrative access controls are audited to limit the potential pool of attackers who could trigger this vulnerability.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 6.5.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wxcc-gvfv-56fg","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-wxcc-gvfv-56fg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd","name":"https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd","tags":["x_refsource_MISC"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:43.038Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in ChurchCRM allows authenticated users to execute arbitrary SQL queries via the EN_tyid parameter in EventEditor.php.

Executive Summary:
ChurchCRM versions prior to 6.5.0 contain a high-severity SQL injection vulnerability that permits authenticated attackers with event management permissions to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-67751

Affected Software: ChurchCRM CRM

Affected Versions: < 6.5.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) located in the EventEditor.php file. An authenticated user possessing event management privileges (isAddEvent) can inject malicious SQL commands through the unsanitized EN_tyid POST parameter.

Business Impact

The ability to execute arbitrary SQL queries represents a significant risk to data integrity, confidentiality, and availability. An attacker could potentially extract sensitive member information, modify administrative records, or disrupt system operations. Given the CVSS score of 7.2, this vulnerability is classified as High severity, as it provides a clear path for database-level exploitation by an authenticated actor.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.0 or later to ensure the input sanitization patch is applied.

Proactive Monitoring: Review application access logs for suspicious POST requests directed at EventEditor.php, particularly those containing unexpected special characters or SQL syntax patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting common parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 17, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability requires the attacker to hold specific event management privileges, limiting the initial pool of potential threat actors.

Analyst Recommendation

Organizations utilizing ChurchCRM should prioritize this update as part of their next maintenance cycle. Because the vulnerability allows for direct interaction with the database layer, failure to patch could lead to a complete compromise of the application data. Apply the version 6.5.0 update immediately to mitigate the risk of SQL injection.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: < 6.5.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-32vr-ch3p-wmr5","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-32vr-ch3p-wmr5","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:42.986Z
---END_METADATA---

Description Summary:
ChurchCRM versions prior to 6.5.3 suffer from broken access control in the Kiosk Manager feature, allowing authenticated users to perform unauthorized administrative actions.

Executive Summary:
A broken access control vulnerability in ChurchCRM allows authenticated users to perform unauthorized administrative actions, posing a significant risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-66397

Affected Software: ChurchCRM ChurchCRM

Affected Versions: < 6.5.3

Vulnerability: The vulnerability exists due to improper access control within the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions. Any authenticated user can trigger these functions to manipulate kiosk registrations or perform management actions without the required privileges.

Business Impact

The ability for standard users to manipulate kiosk registration and management functions grants unauthorized control over critical operational features. Given the CVSS score of 8.3, this flaw represents a high risk, as it could lead to the unauthorized acceptance of untrusted kiosks, potential data exposure, or the disruption of church management operations.

Remediation Plan

Immediate Action: Update ChurchCRM to version 6.5.3 or later to apply the necessary access control checks.

Proactive Monitoring: Review application access logs for unusual activity associated with Kiosk Manager functions or unauthorized attempts to modify kiosk settings.

Compensating Controls: Restrict access to the application to trusted internal networks and ensure that user roles are strictly defined to limit the potential impact of compromised or malicious accounts.

Exploitation Status

Public Exploit Available: No — exploit_available (false).

Analyst Notes: As of December 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently exploitable by any user possessing standard authentication credentials.

Analyst Recommendation

This vulnerability presents a high risk to administrative integrity within the ChurchCRM platform. Administrators must prioritize the update to version 6.5.3 immediately to remediate the access control flaw and prevent potential unauthorized manipulation of kiosk management features.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: CRM
AFFECTED_VERSIONS: < 6.5.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-whpp-wx64-4qp9","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-whpp-wx64-4qp9","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:43.018Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the ChurchCRM UserEditor.php file allows an authenticated administrator to execute arbitrary SQL commands via the type POST parameter.

Executive Summary:
An authenticated SQL injection vulnerability in ChurchCRM versions prior to 6.5.3 permits an administrator to execute arbitrary database commands, posing a high risk of total system compromise.

Vulnerability Details

CVE-ID: CVE-2025-66396

Affected Software: ChurchCRM CRM

Affected Versions: < 6.5.3

Vulnerability: This vulnerability is a SQL injection (CWE-89) located in the src/UserEditor.php file. It occurs because the application fails to sanitize the keys of the type POST parameter array before including them in SQL queries, which can be triggered by a user with administrator privileges.

Business Impact

The ability to execute arbitrary SQL commands provides an attacker with complete control over the application database, potentially leading to unauthorized data extraction, modification, or deletion. With a CVSS score of 7.2, this vulnerability represents a significant security risk, as a compromised administrative account can leverage this flaw to escalate access or maintain persistence within the environment.

Remediation Plan

Immediate Action: Update ChurchCRM to version 6.5.3 or later immediately to apply the necessary sanitization and type-casting logic.

Proactive Monitoring: Review database audit logs for anomalous query patterns, particularly those originating from the UserEditor.php endpoint or involving unexpected SQL syntax.

Compensating Controls: Implement a Web Application Firewall (WAF) configured to detect and block common SQL injection patterns in HTTP POST requests as a temporary defensive measure.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 18, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to the lack of input validation on user-supplied parameters passed directly to the database layer.

Analyst Recommendation

Given the potential for total database compromise, organizations running ChurchCRM must prioritize upgrading to version 6.5.3. While the attack requires administrative access, the risk remains high due to the potential for lateral movement or malicious activity by a compromised account. Administrators should ensure that all internal access controls are strictly enforced until the patch is applied.

---METADATA---
VENDOR: ChurchCRM
PRODUCT: ChurchCRM
AFFECTED_VERSIONS: < 6.5.3
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c9xf-f3gr-xfwv","name":"https://github.com/ChurchCRM/CRM/security/advisories/GHSA-c9xf-f3gr-xfwv","tags":["x_refsource_CONFIRM"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:42.986Z
---END_METADATA---

Description Summary:
ChurchCRM prior to version 6.5.3 contains a SQL injection vulnerability in the src/ListEvents.php file, allowing authenticated users to execute arbitrary SQL commands via the WhichType parameter.

Executive Summary:
An authenticated SQL injection vulnerability in ChurchCRM versions prior to 6.5.3 poses a critical risk of full database compromise and unauthorized data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-66395

Affected Software: ChurchCRM ChurchCRM

Affected Versions: < 6.5.3

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the src/ListEvents.php file. Any authenticated user can trigger this flaw by sending a malicious payload through the WhichType POST parameter, which lacks proper sanitization and type casting before being processed in SQL queries.

Business Impact

The ability to perform arbitrary SQL queries allows an attacker to exfiltrate, modify, or delete sensitive information, including financial records, personal member data, and user credentials. Given the CVSS score of 8.8, this vulnerability represents a high-severity risk that could lead to the complete compromise of the application and the underlying database integrity.

Remediation Plan

Immediate Action: Upgrade ChurchCRM to version 6.5.3 or later to apply the necessary input validation patches.

Proactive Monitoring: Review application access logs for suspicious POST requests targeting the src/ListEvents.php endpoint, particularly those containing SQL syntax or unusual time-based delay patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block incoming POST requests to src/ListEvents.php that contain unauthorized SQL injection patterns.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of December 19, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows any authenticated user, regardless of their specific role or privilege, to interact directly with the database backend.

Analyst Recommendation

Organizations utilizing ChurchCRM must prioritize the update to version 6.5.3 immediately. Because this vulnerability allows any authenticated user to bypass logical constraints and access the full database, failure to patch leaves the system open to total data compromise. Please verify that all administrative and standard user accounts are secured and monitor for any anomalous database activity while the update is being staged.