Information Disclosure in ChurchCRM Open-Source Management Software
CVE-2025-67874

6.9MEDIUM

Key Information:

Vendor

Churchcrm

Status
Crm
Vendor
CVE Published:
16 December 2025

What is CVE-2025-67874?

ChurchCRM, an open-source church management system, has a vulnerability where it exposes plaintext passwords submitted by users in HTTP responses prior to version 6.5.0. This flaw poses significant risks, as it allows attackers to obtain sensitive credentials easily, potentially exacerbating the effects of other security issues such as cross-site scripting (XSS) and session fixation attacks. Version 6.5.0 addresses this critical issue by ensuring that user credentials are adequately secured against such disclosure.

Affected Version(s)

CRM < 6.5.0

References

https://github.com/ChurchCRM/CRM/security/advisories/GHSA...
x_refsource_CONFIRM
https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b4...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-67874 : Information Disclosure in ChurchCRM Open-Source Management Software