CVE-2025-3573
published 2025-04-15CVE-2025-3573: Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a…
PriorityP424medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.34%
26.3th percentile
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | civicrm | < kalkun 0.8.3.2-1 (forky) | kalkun 0.8.3.2-1 (forky) |
| debian | kalkun | < kalkun 0.8.3.2-1 (forky) | kalkun 0.8.3.2-1 (forky) |
| debian | node-jquery-validation | < kalkun 0.8.3.2-1 (forky) | kalkun 0.8.3.2-1 (forky) |
| debian | phpmyadmin | < kalkun 0.8.3.2-1 (forky) | kalkun 0.8.3.2-1 (forky) |
| debian | znuny | < kalkun 0.8.3.2-1 (forky) | kalkun 0.8.3.2-1 (forky) |
| jquery-validation | jquery-validation | >= 0 < 1.20.0 | 1.20.0 |
| phpmyadmin | phpmyadmin | >= 0 < 4:5.2.2-really+dfsg-1+deb13u1 | 4:5.2.2-really+dfsg-1+deb13u1 |
| phpmyadmin | phpmyadmin | >= 0 < 4:5.2.2-really+dfsg-2 | 4:5.2.2-really+dfsg-2 |
| znuny | znuny | >= 0 < 6.5.16-1 | 6.5.16-1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.3MEDIUM
vendor_oracle6.1MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Hyperion Risk Matrix: Web Client - Unicode (jQuery) — CVE-2025-3573
vendor_oracle·2025-10-15·CVSS 6.1
CVE-2025-3573 [MEDIUM] Oracle Oracle Hyperion Risk Matrix: Web Client - Unicode (jQuery) — CVE-2025-3573
Oracle Oracle Hyperion Risk Matrix: Web Client - Unicode (jQuery) vulnerability
CVE: CVE-2025-3573
CVSS: 6.1
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Red Hat
jquery-validation: XSS Vulnerability in jquery-validation
vendor_redhat·2025-04-15·CVSS 5.3
CVE-2025-3573 [MEDIUM] CWE-79 jquery-validation: XSS Vulnerability in jquery-validation
jquery-validation: XSS Vulnerability in jquery-validation
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
A flaw was found in the jquery-validation package. This vulnerability allows Cross-site scripting (XSS) via a user-controlled placeholder value passed to the showLabel() function, which populates messages using the $.validator.messages dictionary.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to w
Debian
CVE-2025-3573: civicrm - Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-...
vendor_debian·2025·CVSS 5.3
CVE-2025-3573 [MEDIUM] CVE-2025-3573: civicrm - Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-...
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
Scope: local
bullseye: open
OSV
CVE-2025-3573: Versions of the package jquery-validation before 1
osv·2025-04-15·CVSS 5.3
CVE-2025-3573 [MEDIUM] CVE-2025-3573: Versions of the package jquery-validation before 1
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
OSV
jquery-validation vulnerable to Cross-site Scripting
osv·2025-04-15
CVE-2025-3573 [MEDIUM] jquery-validation vulnerable to Cross-site Scripting
jquery-validation vulnerable to Cross-site Scripting
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
GHSA
jquery-validation vulnerable to Cross-site Scripting
ghsa·2025-04-15
CVE-2025-3573 [MEDIUM] CWE-79 jquery-validation vulnerable to Cross-site Scripting
jquery-validation vulnerable to Cross-site Scripting
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-15
Published