DEBIAN-CVE-2025-65187

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2025-65187

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-65187.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-65187

Upstream

CVE-2025-65187

Published

2025-12-02T16:15:56Z

Modified

2026-08-27T23:05:42Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.

References

https://security-tracker.debian.org/tracker/CVE-2025-65187

Affected packages

Debian:11 / civicrm

Package

Name: civicrm
Purl: pkg:deb/debian/civicrm?arch=source&distro=bullseye

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.33.2+dfsg1-1

5.50.1+dfsg1-1

5.50.3+dfsg1-1

5.52.2+dfsg1-1

5.53.0+dfsg1-1

5.68.1+dfsg1-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-65187.json"