CVE-2025-65187

{
  "id": "CVE-2025-65187",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-02T16:15:56.157",
  "lastModified": "2026-11-04T23:10:00.223",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Stored Cross-Site Scripting existe en CiviCRM antes de la v6.7 en el campo “Accounting Batches”. Un usuario autenticado puede inyectar JavaScript malicioso en este campo y se ejecuta cada vez que se visualiza la página."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-02T19:30:14.402949Z",
          "id": "CVE-2025-65187",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:civicrm:civicrm:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "6.7.0",
              "matchCriteriaId": "A784BC9B-ABBB-4AFC-A8D3-A6A82122C0FC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://civicrm.com/",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://github.com/lukehebe/Vulnerability-Disclosures/blob/main/CVE-2025-65187.pdf",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    }
  ]
}