{"id":"CVE-2025-65233","title":"Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser…","summary":"Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"slims_project","product":"slims","affected":["slims < 9.6.0"],"patched":["slims 9.6.0"],"published":"2025-12-17","updated":"2026-10-13","sourceUpdated":"2026-10-13T11:10:00.203","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-65233","references":[{"url":"https://github.com/hbtw25/vulnerability-research/tree/main/CVE-2025-65233","label":"cve@mitre.org"},{"url":"https://github.com/slims/slims9_bulian/issues/185","label":"cve@mitre.org"}],"tags":["nvd"],"epss":0.00224,"epssPercentile":0.12004,"ingestedAt":"2026-10-13T11:23:51.124Z","slug":"CVE-2025-65233","body":"## Overview\n\nReflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.\n\n## Affected\n\n- `slims < 9.6.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `slims 9.6.0`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}