Is there a public PoC exploit available for CVE-2025-11938?

Yes, a public proof-of-concept exploit is available for CVE-2025-11938. Prioritise patching immediately. EPSS: 0.1%.

ChurchCRM CVE-2025-11938

Q: What is the CVSS score of CVE-2025-11938?

CVE-2025-11938 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Input Validation (CWE-20)

2025-10-19 cna@vuldb.com

PHP Deserialization Churchcrm

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Apr 29, 2026 - 01:34 vuln.today

DescriptionCVE.org

A vulnerability was found in ChurchCRM up to 5.18.0. This vulnerability affects unknown code of the file setup/routes/setup.php. Performing a manipulation of the argument DB_PASSWORD/ROOT_PATH/URL results in deserialization. The attack may be initiated remotely. The attack's complexity is rated as high. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unsafe deserialization in ChurchCRM setup/routes/setup.php allows remote attackers to manipulate DB_PASSWORD, ROOT_PATH, or URL parameters, leading to arbitrary code execution with limited impact. The vulnerability affects versions up to 5.18.0 and has publicly available exploit code, though EPSS exploitation probability remains low at 0.10% percentile, suggesting real-world exploitation is constrained by high attack complexity and difficult exploitability factors.

Technical ContextAI

ChurchCRM is a PHP-based church management system. The vulnerability resides in the setup.php route handler, which deserializes user-controlled input from configuration parameters without proper validation (CWE-20: Improper Input Validation). PHP's unserialize() function, when applied to untrusted data, can trigger object injection attacks if the codebase contains exploitable magic methods (__wakeup, __destruct) in instantiated classes. The attack vector is network-based, targeting the setup endpoint during or after application initialization. The deserialization occurs when processing DB_PASSWORD, ROOT_PATH, or URL arguments, which are typically used for initial database configuration.

RemediationAI

Immediately upgrade ChurchCRM to the latest available version beyond 5.18.0 if available from the project repository. If no patched version has been released (vendor non-response suggests possible project abandonment), implement these compensating controls: (1) Remove or rename setup/routes/setup.php after initial deployment to prevent post-installation access-this is the primary mitigation with minimal side effects, as setup typically runs only once; (2) Restrict access to setup/ directory via web server configuration (nginx/Apache .htaccess or web.config) to localhost or specific administrative IPs, preventing remote exploitation but complicating legitimate remote setup scenarios; (3) Implement input validation in setup.php to reject serialized PHP objects in configuration parameters, or disable PHP's auto_prepend_file and auto_append_file settings if they could load malicious serialized data. Monitor vendor repositories (GitHub, official website) for security patches, as vendor non-responsiveness may indicate the project is no longer actively maintained.