CVEvulnerability
CVE-2025-65187
6.1 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2025-12-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.
Affected configurations
• civicrm civicrm (< 6.7.0)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://civicrm.com/ Product
- https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-65187.pdf Exploit, Third Party Advisory