| Release | Version |
|---|---|
| bullseye | 5.33.2+dfsg1-1 |
| Bug | bullseye | Description |
|---|---|---|
| CVE-2026-72558 | vulnerable (no DSA, postponed) | An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows a ... |
| CVE-2025-65187 | vulnerable (no DSA, postponed) | A Stored Cross Site Scripting vulnerability exists in CiviCRM before v ... |
| CVE-2025-3573 | vulnerable (no DSA, postponed) | Versions of the package jquery-validation before 1.20.0 are vulnerable ... |
| CVE-2023-28115 | vulnerable (no DSA) | Snappy is a PHP library allowing thumbnail, snapshot or PDF generation ... |
| CVE-2023-25440 | vulnerable (no DSA) | Stored Cross Site Scripting (XSS) vulnerability in the add contact fun ... |
| CVE-2021-21252 | vulnerable (no DSA) | The jQuery Validation Plugin provides drop-in validation for your exis ... |
| Bug | Description |
|---|---|
| TEMP-0887330-0F8779 | Multiple vulnerabilities in CiviCRM |
| CVE-2020-36389 | In CiviCRM before 5.28.1 and CiviCRM ESR before 5.27.5 ESR, the CKEdit ... |
| CVE-2020-36388 | In CiviCRM before 5.21.3 and 5.22.x through 5.24.x before 5.24.3, user ... |
| CVE-2018-1999022 | PEAR HTML_QuickForm version 3.2.14 contains an eval injection (CWE-95) ... |
| CVE-2013-5957 | Multiple SQL injection vulnerabilities in CRM/Core/Page/AJAX/Location. ... |
| CVE-2013-4662 | The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through ... |
| CVE-2013-4661 | CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly ... |
| CVE-2011-5239 | CiviCRM 4.0.5 and 4.1.1 does not verify that the server hostname match ... |