CVE-2025-15005

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-15005

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15005.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-15005

Published

2025-12-22T01:16:06.167Z

Modified

2026-03-14T15:01:54.956907Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

[none]

Details

A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Handler. The manipulation of the argument KRECAPTCHASITEKEY/KRECAPTCHASECRETKEY results in use of hard-coded cryptographic key . It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.

References

Affected packages

Git / github.com/couchcms/couchcms

Affected ranges

Type

GIT

Repo

https://github.com/couchcms/couchcms

Events

Introduced

Last affected

cfa2502b1a0e9c911fe2bc501cafd9ad8590c7ed

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4"
        }
    ]
}

Affected versions

v1.*

v1.3.5

v1.4

v1.4.5

v1.4.5RC1

v1.4.5RC2

v1.4.7

v2.*

v2.0

v2.1

v2.2

v2.2.1

v2.3

v2.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15005.json"