CVE-2025-67874
ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other vulnerabilities (e.g., XSS, IDOR, session fixation), enabling attackers to harvest other users’ passwords. Version 6.5.0 fixes the issue.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.35%
- CWE
- CWE-204
- Published
- 2025-12-16
- Last modified
- 2026-03-13
Affected products
- ChurchCRM CRM
Weakness type
Related vulnerabilities
- CVE-2026-9161 — User Enumeration in DernekPlus' Website Template
- CVE-2026-86758 — Snipe-IT before 8.7.0 License Key Exposure via CSV Export
- CVE-2026-19205 — User Enumeration in GastroMenum's GastroMenum Web Panel
- CVE-2026-19080 — Username Enumeration in Menulux Software's Menulux Portal
- CVE-2026-78584 — Observable Response Discrepancy in Kibana Leading to Cross-Space Information Disclosure
- CVE-2026-84307 — Filament: Password validity disclosure for accounts denied panel access on login page
- CVE-2026-81033 — Automatisch through 0.15.0 User Enumeration via Forgot-Password Response Discrepancy
- CVE-2026-75575 — Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method