CVE-2025-66313

HighCVSS 7.2/10Last modified Oct 18, 2026

Description

ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSec parameter. Injecting SLEEP() causes deterministic server-side delays, proving the value is incorporated into a SQL query without proper parameterization. The issue allows data exfiltration and modification via blind techniques.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Dec 1, 2025
Last modified
Oct 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-663147.5Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACCVE-2025-663158.8There is a configuration defect vulnerability in the version server of ZTE MF258K Pro products. Due to improper directory permission settingCVE-2025-663195.5Permission control vulnerability in the resource scheduling module. Impact: Successful exploitation of this vulnerability may affect serviceCVE-2025-66327.8A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious acCVE-2025-663204.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-663214.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-663224.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-663235.5Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect avaiCVE-2025-663245.5Input verification vulnerability in the compression and decompression module. Impact: Successful exploitation of this vulnerability may affeCVE-2025-663255.5Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerability may affect service CVE-2025-663264.7Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-663274.7Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality
CVE-2025-66313: High severity, CVSS 7.2 | Vulnix