CVE Intelligence

Civicrm vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Civicrm products: 2 record(s), with severity, exploitation and fixes.

Civicrm 2

Exploited only (KEV) →

CVE-2026-72558 High · 8.8 CWE-89 Aug 11, 2026
CiviCRM CiviCRM - SQL Injection
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.
CVE-2025-65187 Medium · 6.1 CWE-79 Dec 2, 2025
Cross-site Scripting (XSS) in Civicrm
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and it executes whenever the page is viewed.