What’s Vulnerable › Vulnerabilities

CVE-2025-67874: ChurchCRM has plaintext password return in response

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-16 · updated 2026-10-07
• Weakness: CWE-204

Description

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other vulnerabilities (e.g., XSS, IDOR, session fixation), enabling attackers to harvest other users’ passwords. Version 6.5.0 fixes the issue.

Affected products

• ChurchCRM CRM: before 6.5.0 — fixed in 6.5.0

How to fix

Upgrade to a fixed version: ChurchCRM CRM 6.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/ChurchCRM/CRM/commit/2d6cf7aed9af1b9b47e125d1a2266f8e2a88f3fd
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-p98h-5xcj-5c6x

Get alerted when CVE-2025-67874 or the next vulnerability affects your stack