CI
Product
CiviCRM
11
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 2Medium 3Low 0
Watch
Add CiviCRM to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1999022 | 9.8 | Jul 23 | PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method,… Affected: through 4.6.37; 5.3.0 |
| CVE-2026-72558 | 8.8 | Aug 11 | CiviCRM CiviCRM - SQL Injection Affected: through 6.18.alpha1 |
| CVE-2020-36388 | 8.8 | Jun 17 | In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive Affected: before 5.21.3; 5.22.0 before 5.24.3 |
| CVE-2025-65187 | 6.1 | Dec 2 | A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field Affected: before 6.7.0 |
| CVE-2023-25440 | 5.4 | May 23 | Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field Affected: 5.59 |
| CVE-2020-36389 | 4.3 | Jun 17 | In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF Affected: before 5.27.5; before 5.28.1 |
| CVE-2013-1636 | – | Mar 12 | Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress,… Affected: 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; +34 more |
| CVE-2013-4662 | – | Jan 29 | The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via… Affected: 4.2.0; 4.2.1; 4.2.2; 4.2.4; 4.2.5; 4.2.6; +7 more |
| CVE-2013-4661 | – | Jan 29 | CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +34 more |
| CVE-2013-5957 | – | Nov 27 | Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to… Affected: 4.4; 4.4; 4.4; 4.4; 4.4.0; 4.4.0; +18 more |
| CVE-2011-5239 | – | Nov 6 | CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which… Affected: 4.0.5; 4.1.1 |
Showing 11