CVE-2025-68109

HighCVSS 7.2/10Last modified Oct 1, 2026

Description

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file extension of uploaded files. As a result, an attacker can upload a web shell file and subsequently upload a .htaccess file to enable direct access to it. Once accessed, the uploaded web shell allows remote code execution (RCE) on the server. Version 6.5.3 fixes the issue.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-434 CWE-494 CWE-552 CWE-915

Affected software

No affected versions have been published.

Timeline

Published: Dec 17, 2025
Last modified: Oct 1, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-68119.8Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability al CVE-2025-681108.8ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message includin CVE-2025-681117.2ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists in the `eGive.php` fi CVE-2025-681128.8ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attende CVE-2025-681136.5ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge CVE-2025-681149.8Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs CVE-2025-681156.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0 CVE-2025-681165.4FileRise is a self-hosted web file manager / WebDAV server. Versions prior to 2.7.1 are vulnerable to Stored Cross-Site Scripting (XSS) due CVE-2025-681189.1FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate ha CVE-2025-681197.0Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, do CVE-2025-681205.4To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.CVE-2025-6812110.0During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake