CVE-2025-3573:
Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting (XSS) in the showLabel() function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary.
The package has not entered testing even though the delay is over
normal
The package has not entered testing even though the 5-day delay is over.Check why.
Depends on packages which need a new maintainer
normal
The packages that civicrm depends on which need a new maintainer are:
This package has been requested to
be removed. This means that, when this request gets
processed by an ftp-master, this package will no longer be in
unstable, and will automatically be removed from testing too
afterwards. If for some reason you want keep this package in
unstable, please discuss so in the bug. Please see bug number #1112610 for more information.
Among the 5 debian patches
available in version 5.68.1+dfsg1-1 of the package,
we noticed the following issues:
2 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
Standards version of the package is outdated.
wishlist
The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.7.2 instead of
4.6.2).
![[bug history graph]](https://qa.debian.org/data/bts/graphs/c/civicrm.png){kind=link}