CVE-2025-67751: Churchcrm

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating a new event and selecting an event type, the `EN_tyid` POST parameter is not sanitized. This allows an authenticated user with event management permissions (`isAddEvent`) to execute arbitrary SQL queries. Version 6.5.0 fixes the issue.

Affected products

• Churchcrm Churchcrm: before 6.5.0 (fixed in 6.5.0)

Published 2025-12-16. Last modified 2026-10-07.