Civicrm vulnerabilities

Products

• Civicrm 11

Newest

• civicrm CiviCRM CiviCRM - SQL Injection CVE-2026-72558 8.8 HighAugust 11, 2026
• civicrm A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting... CVE-2025-65187 6.1 MediumDecember 2, 2025
• civicrm Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1,... CVE-2023-25440 Public exploit 5.4 MediumMay 23, 2023
• civicrm In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form... CVE-2020-36389 Fix available 4.3 MediumJune 17, 2021
• civicrm In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and... CVE-2020-36388 Fix available 8.8 HighJune 17, 2021
• html quickform project quickform, civicrm +1 more PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in... CVE-2018-1999022 Fix available 9.8 CriticalJuly 23, 2018
• civicrm private report Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x... CVE-2015-4391 6.8 MediumJune 15, 2015
• civicrm, caseproof prettylinks, joobi com jnews +2 more Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open... CVE-2013-1636 Public exploit 4.3 MediumMarch 12, 2014
• civicrm CiviCRM SQL injection vulnerability via Quick Search API CVE-2013-4662 Fix available 6.5 MediumJanuary 29, 2014
• civicrm CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access... CVE-2013-4661 4.9 MediumJanuary 29, 2014
• civicrm Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2... CVE-2013-5957 7.5 HighNovember 27, 2013
• civicrm CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the... CVE-2011-5239 5.8 MediumNovember 6, 2012