#VU125714 Observable Response Discrepancy in ChurchCRM - CVE-2025-67874

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU125714

#VU125714 Observable Response Discrepancy in ChurchCRM - CVE-2025-67874

Published: April 9, 2026


Vulnerability identifier: #VU125714
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-67874
CWE-ID: CWE-204
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
ChurchCRM
Software vendor:
ChurchCRM

Description

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to observable response discrepancy in HTTP responses when processing user-supplied passwords. A remote privileged user can submit a password and receive it back in plaintext in the response to disclose sensitive information.

This can occur in workflows such as registration, password change or reset, and login error handling.


Remediation

Install security update from vendor's website.

External links