CiviCRM vulnerabilities
We track 1 vulnerability in CiviCRM products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on August 11, 2026.
1vulnerabilities
0critical
1high
0exploited
8.8average CVSS score
Latest CiviCRM vulnerabilities
- 8.8 High severity
CiviCRM: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with st