PT-2025-48712 · Civicrm+1 · Civicrm+1

Published 2025-12-02 · Updated 2025-12-02 · CVE-2025-65187

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CiviCRM versions prior to 6.7

Description A stored cross site scripting issue exists. An authenticated user can inject malicious JavaScript into the Accounting Batches field, and this script executes when the page is viewed.

Recommendations Update to version 6.7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-65187

Affected Products

Civicrm

Debian

References · 11

• 🔥 https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-65187.pdf · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-65187 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65187 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-65187 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65187 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-65187 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-65187 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-65187 · Security Note
• https://t.me/CVEtracker/38694 · Telegram Post
• https://twitter.com/CVEnew/status/1995885144847093955 · Twitter Post
• https://civicrm.com · Note