CVE-2026-72558 in CiviCRM
요약
\~에 의해 MITRE • 2026. 08. 11.
An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The clause concatenates a user-supplied value into the SQL query without sanitization. An attacker with staff-level access can exfiltrate all database contents including donor and member records.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.