CVE-2025-68110

Critical

Published: 17/12/2025(UTC)Translated: 05/08/2026(UTC)NVD NIST

Summary

ChurchCRM before version 6.5.3 may disclose database information in error messages, including host, IP, username, and password. Version 6.5.3 fixes the issue.

Risk Assessment

Disclosure of database credentials in error messages could allow an attacker to gain unauthorized access to the database and sensitive information.

Recommendation

It is recommended to upgrade ChurchCRM to version 6.5.3 or later to prevent credential leakage in error messages.

Original NVD description (English source)

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.