CVE-2025-68110 | ChurchCRM is an open-source church management system. Versio… | CVSS 10.0 CRITICAL

Description

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.

Metadata

CVE ID: CVE-2025-68110
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2025-12-15 14:44 UTC
Published: 2025-12-17 21:33 UTC
Last updated: 2025-12-18 15:08 UTC
Primary CWE: CWE-200
CWE-200: Exposure of Sensitive Information to an Unauthorize…
Vendor / Product: ChurchCRM / CRM
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: PoC
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
ChurchCRM	CRM	—	< 6.5.3

Weakness (CWE)

CWE	Source	Description
CWE-200	cna	CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-209	cna	CWE-209: Generation of Error Message Containing Sensitive Information

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

https://github.com/ChurchCRM/CRM/security/advisories/GHSA-82mq-xc2j-3qv2 https://github.com/ChurchCRM/CRM/security/advisories/GHSA-82mq-xc2j-3qv2