CVE catalog
CVE-2025-65187
UBUNTU-CVE-2025-65187
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.22% · Oct 25, 2026
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | civicrm | 11 | 5.33.2+dfsg1-1 | vulnerable |
| Debian | civicrm | 11 | 5.50.1+dfsg1-1 | vulnerable |
| Debian | civicrm | 11 | 5.50.3+dfsg1-1 | vulnerable |
| Debian | civicrm | 11 | 5.52.2+dfsg1-1 | vulnerable |
| Debian | civicrm | 11 | 5.53.0+dfsg1-1 | vulnerable |
| Debian | civicrm | 11 | 5.68.1+dfsg1-1 | vulnerable |
| Ubuntu | civicrm | pro | 5.33.2+dfsg1-1 | vulnerable |
| Ubuntu | civicrm | pro | 5.33.2+dfsg1-1build1 | vulnerable |
| Ubuntu | civicrm | pro | 5.33.2+dfsg1-1ubuntu1 | vulnerable |
| Ubuntu | civicrm | pro | 5.33.2+dfsg1-1ubuntu1+esm1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: