CVE-2025-68110 ChurchCRM discloses database information on error message

Critical 10.0 Published 17 Dec 2025 Updated 18 Dec 2025

An attacker can view sensitive database credentials including host, IP, username, and password via error messages in ChurchCRM.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-68110?

CVE-2025-68110 is a critical vulnerability in Churchcrm Churchcrm, published on 17 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, username, and password. Version 6.5.3 fixes the issue.

Weakness: CWE-209, CWE-200

Which versions are affected by CVE-2025-68110?

It affects 1 product.

Products include Churchcrm Churchcrm.

How do I fix CVE-2025-68110?

No fix has been published for CVE-2025-68110 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-68110 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-68110 exists.

All Churchcrm Churchcrm vulnerabilities

Sources

Also known as GHSA-82mq-xc2j-3qv2.