CiviCRM records
11 published records for vendor civicrm.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 2
- With a fix record
- 36.4%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')3
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2
- CWE-352 Cross-Site Request Forgery (CSRF)2
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
- CWE-434 Unrestricted Upload of File with Dangerous Type1
- CWE-264 Permissions, Privileges, and Access Controls1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
11 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2018-1999022No exploit | PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickFohtml quickform project · html quickform · CWE-94 | Critical9.8 | — | 2.2% | Jul 23, 2018 |
35Monitor | CVE-2020-36388No exploit | In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.civicrm · civicrm · CWE-434 | High8.8 | — | 1.4% | Jun 17, 2021 |
31Monitor | CVE-2013-5957No exploit | Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4civicrm · civicrm · CWE-89 | High7.5 | — | 2.0% | Nov 27, 2013 |
27Monitor | CVE-2015-4391No exploit | Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Dcivicrm · civicrm private report · CWE-352 | Medium6.8 | — | 0.6% | Jun 15, 2015 |
26Monitor | CVE-2013-4662No exploit | The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layercivicrm · civicrm · CWE-89 | Medium6.5 | — | 1.0% | Jan 29, 2014 |
24Monitor | CVE-2025-65187No exploit | A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field.civicrm · civicrm · CWE-79 | Medium6.1 | — | 0.2% | Dec 2, 2025 |
23Monitor | CVE-2011-5239No exploit | CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fcivicrm · civicrm · CWE-20 | Medium5.8 | — | 0.5% | Nov 6, 2012 |
22Monitor | CVE-2023-25440Proof of concept | Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code civicrm · civicrm · CWE-79 | Medium5.4 | — | 2.5% | May 22, 2023 |
19Monitor | CVE-2013-1636Proof of concept | Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Litecaseproof · prettylinks · CWE-79 | Medium4.3 | — | 6.3% | Mar 12, 2014 |
19Monitor | CVE-2013-4661No exploit | CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custcivicrm · civicrm · CWE-264 | Medium4.9 | — | 0.9% | Jan 29, 2014 |
17Monitor | CVE-2020-36389No exploit | In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.civicrm · civicrm · CWE-352 | Medium4.3 | — | 0.6% | Jun 17, 2021 |
- CVE-2018-199902240Plan
PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickFo
CriticalCVSS 9.8No exploitEPSS 2%html quickform project · html quickformJul 23, 2018
- CVE-2020-3638835Monitor
In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.
HighCVSS 8.8No exploitEPSS 1%civicrm · civicrmJun 17, 2021
- CVE-2013-595731Monitor
Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4
HighCVSS 7.5No exploitEPSS 2%civicrm · civicrmNov 27, 2013
- CVE-2015-439127Monitor
Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for D
MediumCVSS 6.8No exploitEPSS 0%civicrm · civicrm private reportJun 15, 2015
- CVE-2013-466226Monitor
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer
MediumCVSS 6.5No exploitEPSS 1%civicrm · civicrmJan 29, 2014
- CVE-2025-6518724Monitor
A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field.
MediumCVSS 6.1No exploitEPSS 0%civicrm · civicrmDec 2, 2025
- CVE-2011-523923Monitor
CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName f
MediumCVSS 5.8No exploitEPSS 0%civicrm · civicrmNov 6, 2012
- CVE-2023-2544022Monitor
Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code
MediumCVSS 5.4Proof of conceptEPSS 2%civicrm · civicrmMay 22, 2023
- CVE-2013-163619Monitor
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite
MediumCVSS 4.3Proof of conceptEPSS 6%caseproof · prettylinksMar 12, 2014
- CVE-2013-466119Monitor
CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default cust
MediumCVSS 4.9No exploitEPSS 0%civicrm · civicrmJan 29, 2014
- CVE-2020-3638917Monitor
In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.
MediumCVSS 4.3No exploitEPSS 0%civicrm · civicrmJun 17, 2021