CVE-2025-65187 — Cross-site Scripting in Civicrm

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 79.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
CivicrmDebian Civicrm
Timeline
PublishedDec 2

Description

A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages2 packages

▶NVDcivicrm/civicrm< 6.7.0

🔴Vulnerability Details

2
OSV
CVE-2025-65187: A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6↗2025-12-02
▶
GHSA
GHSA-cf64-8857-h96q: A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6↗2025-12-02
▶

📋Vendor Advisories

1
Debian
CVE-2025-65187: civicrm - A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the...↗2025
▶