CVE-2025-65187

6.1 mediumEPSS 0.2%

Medium (6.1) in civicrm civicrm. EPSS 0.2% chance of exploitation in the next 30 days.

A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-12-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

civicrm:civicrm

References

https://civicrm.com/
https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-65187.pdf

Check your stack JSON