CVE•Published 2025-12-17•Modified 2026-10-01•2 articles on news•5 live references•NVD data

CVE-2025-68109Churchcrm · Churchcrm

Vulnerability data via NVD (ingested)

CVSS v3.1

9.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS percentile

Exploit Prediction Scoring System · top 26% of all CVEs

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-434Unrestricted Upload of File with Dangerous Type CWE-494Download of Code Without Integrity Check CWE-552Files or Directories Accessible to External Parties CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes

Description

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

Timeline

Published 2025-12-17

Modified 2026-10-01

External references

NVD MITRE Exploit-DB GitHub PoC VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2025-68109

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Churchcrm Churchcrm"

All exposed Churchcrm Churchcrm instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Churchcrm"

HTTP body or banner mentions "Churchcrm" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2025-68109