Yüksek CVSS 8.8
CVE-2026-72558: CVE-2026-72558: SQL enjeksiyonu
Açıklama (NVD)
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.
Özet bilgiler
- CVSS v3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,43 (yüzdelik 37)
- CWE
- CWE-89
- Yama
- Yok / bilinmiyor