by Kastro
Paper/Archive/CVE-2025-68110

CVE-2025-68110

ChurchCRM CRM — ChurchCRM discloses database information on error message

EPSS 0.4%public exploitCVSS 10.0
critical.is priorityof 100
47
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 36.6.366 × 207.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.

Affected

ProductAffectedFixed inSource
CRM< 6.5.3–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/ChurchCRM/CRM/security/advisories/GHSA-82mq-xc2j-3qv2