CVE-2025-68400

🗓️ 17 Dec 2025 21:42:21Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 15 Views🌐 WEB

ChurchCRM ConfirmReportEmail.php enables time-based blind injection via familyId for authenticated users; fixed in version 6.5.3.

Reporter	Title	Published	Views	Family All 10
GithubExploit	Exploit for SQL Injection in Churchcrm	11 Apr 202619:13	–	githubexploit
CNNVD	ChurchCRM SQL注入漏洞	17 Dec 202500:00	–	cnnvd
CNVD	ChurchCRM legacy endpoint SQL injection vulnerability	19 Dec 202500:00	–	cnvd
Cvelist	CVE-2025-68400 ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php	17 Dec 202521:42	–	cvelist
EUVD	EUVD-2025-204001	17 Dec 202521:42	–	euvd
NVD	CVE-2025-68400	17 Dec 202522:16	–	nvd
OSV	CVE-2025-68400 ChurchCRM vulnerable to time-based blind SQL Injection in ConfirmReportEmail.php	17 Dec 202521:42	–	osv
Packet Storm	📄 ChurchCRM SQL Injection	13 Apr 202600:00	–	packetstorm
Positive Technologies	PT-2025-51932	17 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-68400	18 Dec 202522:37	–	redhatcve

NVD

Vulners

Node

churchcrm churchcrmRange<6.5.3

[
  {
    "vendor": "ChurchCRM",
    "product": "CRM",
    "versions": [
      {
        "version": "< 6.5.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/ChurchCRM/CRM/security/advisories/GHSA-v54g-2pvg-gvp2

Parameter	Position	Path	Description	CWE
familyId	query param	/Reports/ConfirmReportEmail.php	SQL Injection via legacy endpoint ConfirmReportEmail.php using familyId parameter	CWE-89

18 Dec 2025 16:46Current

7.6High risk

Vulners AI Score7.6

CVSS 3.18.8

CVSS 49.3

EPSS0.00052

CWE-89