Sign inStart freeBook a demo

Civicrm vulnerabilitiesNone on the known-exploited list.

Vendor
The short answer

Civicrm has 10 published vulnerabilities across 2 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Civicrm, with 9. If you run Civicrm software, patch the exploited flaws first.

See the exploited flaws

We keep watching the known-exploited list.

Products

Which Civicrm products have the most vulnerabilities?

Civicrm leads with 9 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.

  1. Civicrm9
  2. Civicrm Private Report1
Published vulnerabilities
Known exploited

Which Civicrm vulnerabilities are being exploited?

This is the list that matters most: flaws criminals are using now.

None of Civicrm's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.

Exploit likelihood

Which Civicrm flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.

50% or more10% to 49%Under 10%
  1. 6.3%
    CVE-2013-1636Medium

    Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for...

    CVSS4.3Published12 Mar 2014
  2. 2.5%
    CVE-2023-25440Medium

    Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to execute arbitrary code in first/second name field.

    CVSS5.4Published23 May 2023
  3. 2.2%
    CVE-2018-1999022Critical

    PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) vulnerability in HTML_QuickForm's getSubmitValue method, HTML_QuickForm's validate method, HTML_QuickForm_hierselect's _setOptions method,...

    CVSS9.8Published23 Jul 2018
  4. 2.1%
    CVE-2013-5957High

    Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location.php in CiviCRM before 4.2.12, 4.3.x before 4.3.7, and 4.4.x before 4.4.beta4 allow remote attackers to execute arbitrary SQL commands via the...

    CVSS7.5Published27 Nov 2013
  5. 1.4%
    CVE-2020-36388High

    In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, users may be able to upload and execute a crafted PHAR archive.

    CVSS8.8Published17 Jun 2021
  6. 1.0%
    CVE-2013-4662Medium

    The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second...

    CVSS6.5Published29 Jan 2014
  7. 1.0%
    CVE-2013-4661Medium

    CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custom searches, which allows remote authenticated users with the "access...

    CVSS4.9Published29 Jan 2014
  8. 0.7%
    CVE-2020-36389Medium

    In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEditor configuration form allows CSRF.

    CVSS4.3Published17 Jun 2021
  9. 0.6%
    CVE-2015-4391Medium

    Cross-site request forgery (CSRF) vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for...

    CVSS6.8Published15 Jun 2015
  10. 0.5%
    CVE-2011-5239Medium

    CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to...

    CVSS5.8Published6 Nov 2012
Every product

All Civicrm products we track.

2 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.

Precursor Intelligence

Running Civicrm? We'll keep checking.

Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.

  1. Tell us what you runPick your software from a list, or let us work it out from your website.
  2. We match it to every flawOver 400,000 published flaws, checked against your list.
  3. Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
  4. Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Start free →Book a demo

Free plan, no card needed. Nothing to install.

FAQ

Common questions, answered plainly.

Something else? Talk to the team →

Our catalogue lists 10 published vulnerabilities across 2 products and 399 versions from Civicrm.

None of Civicrm's vulnerabilities is on the list of flaws known to be exploited today.

Civicrm, with 9 published vulnerabilities. Its own page lists the ones known to be exploited.

Create a Precursor Intelligence account and track the Civicrm products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

Keep exploring