PT-2025-51358 · Churchcrm · Churchcrm

Mateusz-Sa · Published 2025-12-16 · Updated 2025-12-21 · CVE-2025-67874

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.0

Description The application returns passwords submitted by users in plain text within HTTP responses. This disclosure of credentials could lead to their compromise and potentially amplify the impact of other issues like Cross-Site Scripting (XSS), Improper Access Control (IDOR), and session fixation, allowing attackers to obtain user passwords.

Recommendations Update to version 6.5.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2025-67874

GHSA-P98H-5XCJ-5C6X

Affected Products

Churchcrm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67874.json · Exploit
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p98h-5xcj-5c6x · Vendor Advisory
• https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd · Patch
• https://osv.dev/vulnerability/CVE-2025-67874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67874 · Security Note
• https://t.me/cveNotify/146082 · Telegram Post
• https://twitter.com/CVEnew/status/2002836001417261357 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2000827697484693760 · Twitter Post
• https://t.me/CVEtracker/39906 · Telegram Post