CVE-2025-15005 - CouchCMS reCAPTCHA config.example.php hard-coded key

Back Back to CVE browser

MEDIUM

CouchCMS reCAPTCHA config.example.php hard-coded key

Published Dec 22, 2025

6.3

MEDIUM

CVSS 4.0

EPSS 0.46%

Description

A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Handler. The manipulation of the argument K_RECAPTCHA_SITE_KEY/K_RECAPTCHA_SECRET_KEY results in use of hard-coded cryptographic key . It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.

Affected products

Vendor Couchcms Product CouchCMS Default
n/a
- Version
  2.0
  Status
  affected
  Constraints
  -
- Version
  2.1
  Status
  affected
  Constraints
  -
- Version
  2.2
  Status
  affected
  Constraints
  -
- Version
  2.3
  Status
  affected
  Constraints
  -
- Version
  2.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Couchcms

CouchCMS

n/a

Version	Status	Constraints
2.0	affected	-
2.1	affected	-
2.2	affected	-
2.3	affected	-
2.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-320

CWE-321

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204679
Advisory
https://note-hxlab.wetolink.com/share/jNNcrdrNyCvl
relatedExploitThird Party Advisory
https://note-hxlab.wetolink.com/share/jNNcrdrNyCvl#-span--strong-proof-of-concept---strong---span-
exploitThird Party Advisory
https://vuldb.com/?ctiid.337711
signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.337711
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.718998
third-party-advisoryThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-204679		Advisory
https://note-hxlab.wetolink.com/share/jNNcrdrNyCvl		relatedExploitThird Party Advisory
https://note-hxlab.wetolink.com/share/jNNcrdrNyCvl#-span--strong-proof-of-concept---strong---span-		exploitThird Party Advisory
https://vuldb.com/?ctiid.337711		signaturepermissions-requiredPermissions RequiredVDB Entry
https://vuldb.com/?id.337711		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/?submit.718998		third-party-advisoryThird Party AdvisoryVDB Entry