CVE-2025-67874Medium· 6.5▾ SunlitChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk o…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other vulnerabilities (e.g., XSS, IDOR, session fixation), enabling attackers to harvest other users’ passwords. Version 6.5.0 fixes the issue.
churchcrm < 6.5.0Upgrade past the affected range:
churchcrm 6.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2025-67751High· 7.2ChurchCRM is an open-source church management system
CVE-2025-68109Critical· 9.1ChurchCRM is an open-source church management system
CVE-2025-67875Medium· 5.4ChurchCRM is an open-source church management system
CVE-2026-100164High· 7.5User Enumeration in Rolantis Information Technologies' Agentis
CVE-2026-49442Medium· 5.3Cacti: User Enumeration via Error Messages
CVE-2024-7478Medium· 5.8Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery