PT-2025-51941 · Churchcrm · Churchcrm

Mateusz-Sa · Published 2025-12-17 · Updated 2025-12-20 · CVE-2025-68401

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.0.0

Description The application inadequately sanitizes or encodes user-supplied HTML/JS, leading to stored cross-site scripting (XSS). This allows an attacker to execute JavaScript in the browsers of other users viewing the content. The script can access web origin data and perform actions with the victim's privileges. If session cookies are not marked as HttpOnly, the script can read cookie data, potentially enabling session theft and account takeover.

Recommendations Update to version 6.0.0 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-68401

GHSA-PHFW-P278-QQ7V

Affected Products

Churchcrm

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68401.json · Exploit
• 🔥 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-phfw-p278-qq7v · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-68401 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68401 · Vendor Advisory
• https://twitter.com/CVEnew/status/2002487813347151922 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2001444652222669112 · Twitter Post