CVE-2025-65187

15th percentile - higher than 15% of all known CVEs

A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field, which executes whenever the page is viewed.

An attacker with a valid account can store a malicious script that executes in other users' browsers, including administrators, enabling session theft or data manipulation.

Update CiviCRM to v6.7 or later and implement input sanitization for the Accounting Batches field. Consider deploying Content-Security-Policy headers.