Unrated severityNVD Advisory· Published May 23, 2023· Updated Jan 31, 2025

CVE-2023-25440

Description

Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Civicrm/Civicrmcpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: = 5.59.alpha1
osv-coords
pkg:bitnami/civicrm
Range: >= 5.59-alpha1.0, <= 5.59-alpha1.0

Patches

Vulnerability mechanics

References

civicrm.orgmitre
packetstormsecurity.com/files/172470/CiviCRM-5.59.alpha1-Cross-Site-Scripting.htmlmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.002
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000