CiviCRM is a web-based constituent relationship management platform designed for nonprofits and membership organizations, presenting an application-layer attack surface centered on a single core product. Vulnerabilities affecting the platform cluster around input-handling and web-application weaknesses including cross-site scripting, SQL injection, code injection, CSRF, and improper input validation, reflecting the common risks of form-driven web applications with database backends. The platform exhibits a meaningful tendency toward serious severity outcomes and frequently acquires public exploit code. Current exploitation activity, severity breakdown, and detailed exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Civicrm over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-1999022CRITICAL PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hie | Jul 23, 2018 | 9.8 | 29 | NO | NO |
CVE-2023-25440MEDIUM Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field. | May 23, 2023 | 5.4 | 28 | NO | YES |
CVE-2013-1636MEDIUM Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNew | Mar 12, 2014 | 4.3 | 23 | NO | YES |
CVE-2020-36388HIGH In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive. | Jun 17, 2021 | 8.8 | 22 | NO | NO |
CVE-2025-65187MEDIUM A Stored Cross Site Scripting vulnerability exists in CiviCRM before v6.7 in the Accounting Batches field. An authenticated user can inject malicious JavaScript into this field and | Dec 2, 2025 | 6.1 | 21 | NO | NO |
CVE-2013-5957HIGH Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute | Nov 27, 2013 | 7.5 | 20 | NO | NO |
CVE-2011-5239MEDIUM CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which all | Nov 6, 2012 | 5.8 | 19 | NO | NO |
CVE-2015-4391MEDIUM Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack | Jun 15, 2015 | 6.8 | 18 | NO | NO |
CVE-2013-4662MEDIUM The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a | Jan 29, 2014 | 6.5 | 17 | NO | NO |
CVE-2020-36389MEDIUM In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF. | Jun 17, 2021 | 4.3 | 15 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Civicrm.
Media articles that mention a CVE ID that affects a product developed by Civicrm — matched by CVE ID, not by vendor name.