{"id":"CVE-2023-25440","aliases":["BIT-civicrm-2023-25440","DEBIAN-CVE-2023-25440","EUVD-2023-29395","GHSA-w275-2cjx-pq96","UBUNTU-CVE-2023-25440"],"status":"published","title":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1,...","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02537,"percentile":0.8507,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2023-05-23T00:00:00Z","modified":"2026-08-27T23:04:37Z","exploits":[{"source":"exploitdb","id":"EDB-51478","title":"CiviCRM 5.59.alpha1 - Stored XSS (Cross-Site Scripting)","type":"webapps","platform":"php","date":"2023-05-23","url":"https://www.exploit-db.com/exploits/51478"}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"civicrm","ranges":[{"type":"SEMVER","events":[{"introduced":"5.59-alpha1.0"},{"last_affected":"5.59-alpha1.0"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.33.2+dfsg1-1","5.50.1+dfsg1-1","5.50.3+dfsg1-1","5.52.2+dfsg1-1","5.53.0+dfsg1-1","5.68.1+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.1+dfsg-1","4.7.1+dfsg-2","4.7.1+dfsg-2ubuntu1","4.7.1+dfsg-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.23+dfsg-1ubuntu1","4.7.24+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1","4.7.30+dfsg-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0+dfsg-1","5.18.1+dfsg-1","5.20.3+dfsg-1","5.21.0+dfsg-1","5.21.1+dfsg-1","5.21.2+dfsg-1","5.21.2+dfsg-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"civicrm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.33.2+dfsg1-1","5.33.2+dfsg1-1build1","5.33.2+dfsg1-1ubuntu1","5.33.2+dfsg1-1ubuntu1+esm1"]}],"products":[{"vendor":"civicrm","product":"civicrm"}],"references":[{"url":"https://civicrm.org/","tags":["x_transferred","Product","web","report"]},{"url":"https://packetstormsecurity.com/files/172470/CiviCRM-5.59.alpha1-Cross-Site-Scripting.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","web","evidence","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-25440"},{"url":"https://civicrm.org"},{"url":"https://github.com/advisories/GHSA-w275-2cjx-pq96"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-25440","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-25440","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-25440","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-25440","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2023-05-23T00:00:00Z","modified":"2025-01-31T13:49:50.574Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:19.559321Z"}],"euvd":[{"id":"EUVD-2023-29395","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2023-05-23T00:00:00Z","modified":"2025-01-31T13:49:50Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:08.578338Z"}],"ghsa":[{"id":"GHSA-w275-2cjx-pq96","title":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1,...","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2023-05-23T03:30:15Z","modified":"2024-04-04T04:17:12Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:22.389253Z"}],"nvd":[{"id":"CVE-2023-25440","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2023-05-23T01:15:09.727Z","modified":"2026-06-17T05:41:14.477Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:03.200773Z"}],"osv":[{"id":"CVE-2023-25440","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2023-05-23T01:15:09.727Z","modified":"2026-03-14T12:02:38.390248Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-25440","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2023-05-23T01:15:09.727Z","modified":"2026-08-27T23:04:37.786597754Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-25440","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2023-05-23T01:15:00Z","modified":"2026-05-08T12:41:16.808545Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"BIT-civicrm-2023-25440","description":"Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.","status":"published","published":"2024-01-31T15:12:17.083Z","modified":"2024-02-19T10:36:29.17Z","updated_at":"2026-11-02T15:28:28.70813Z"}]}}