Skip to content
OpenAdvisories

Package · Debian

civicrm

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.8
    CVE-2026-72558

    CiviCRM CiviCRM - SQL Injection

    An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with s…

    CiviCRM CiviCRM civicrm civicrm Debian Ubuntu
  • Medium 6.1
    CVE-2025-65187

    A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authentic…

    civicrm civicrm Debian Ubuntu
  • Medium 5.4
    CVE-2023-25440 Public exploit

    Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to ex…

    civicrm civicrm Debian Ubuntu
  • Critical 9.8
    CVE-2023-28115

    Snappy vulnerable to PHAR deserialization, allowing remote code execution

    Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR deserialization due to a lack of checking on the protocol before passing it into the `file_exists()` functio…

    KnpLabs snappy civicrm civicrm Debian Ubuntu Packagist
  • Unscored —
    CVE-2020-36389

    In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.

    civicrm civicrm Debian Ubuntu
  • Unscored —
    CVE-2020-36388

    In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHA…

    civicrm civicrm Debian Ubuntu
  • Unscored —
    CVE-2018-1999022

    PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue…

    civicrm civicrm Debian Ubuntu