CVE-2025-65187

PoC —

CVSS 3.1

6.1 medium

EPSS

<1%p13

Published

Dec 2, 2025 (Dec 2, 2025)

Modified

Jun 17, 2026

Description

A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.

Vendors: civicrm
Products: civicrm
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.