CVE-2025-68400

CVE-2025-68400: ChurchCRM의 ConfirmReportEmail.php에서 시간 기반 블라인드 SQL 인젝션 취약점 개요 필드| 세부정보 ---|--- CVE ID| CVE-2025-68400 심각도| CRITICAL 권고| 권고 보기 발견자| Lukasz Rybak 영향을 받는 제품 ChurchCRM/CRM 세부정보 요약 ChurchCRM 6.3.0의 레거시 엔드포인트 /Reports/ConfirmReportEmail.php에 치명적인 SQL 인젝션 취약점이 존재합니다. 이 기능은 UI에서 제거되었지만, 해...

CVE-2026-39341: Improper Neutralization of Special Elements used in an SQL Command

ChurchCRM is an open-source church management system. Prior to 7.1.0, the application is vulnerable to time-based SQL injection due to an improper input validation. Endpoint Reports/ConfirmReportEmail.php?familyId= is not correctly sanitising user input, specifically, the sanitised input is not...

CVE-2025-68400

ChurchCRM prior to v6.5.3 is affected by a SQL Injection in the legacy endpoint /Reports/ConfirmReportEmail.php. The issue arises from an unvalidated familyId parameter in a historically removed UI feature that remains reachable directly (dead but reachable code). Any authenticated user, even wit...

CVE-2025-68400: Improper Neutralization of Special Elements used in an SQL Command

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint /Reports/ConfirmReportEmail.php in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed and reachable directly via URL. This is a...