CVE-2025-65233: XSS
Reflected cross-site scripting (XSS) in SLiMS (slims9bulian) before 9.6.0 via improper handling of $SERVER['PHPSELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SLiMS (slims9_bulian)to a version that resolves this vulnerability.Fixed in 9.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65233?
CVE-2025-65233 has a severity rating that indicates a high risk due to its potential for reflected cross-site scripting attacks.
How do I fix CVE-2025-65233?
To fix CVE-2025-65233, upgrade SLiMS to version 9.6.0 or later, which addresses the vulnerability.
Who is affected by CVE-2025-65233?
Users of SLiMS versions prior to 9.6.0 are affected by CVE-2025-65233.
What type of vulnerability is CVE-2025-65233?
CVE-2025-65233 is a reflected cross-site scripting (XSS) vulnerability.
Can CVE-2025-65233 allow execution of arbitrary code?
Yes, CVE-2025-65233 can allow remote attackers to execute arbitrary JavaScript in the victim's browser.