Read the docs
TI-2026-12330 Aliases CVE-2026-14633GHSA-mc49-c33w-7xvv

kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site scripting

Priority MEDIUM 57CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.

Summary

A vulnerability was determined in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 49b20f53de2b7ec34e920b11c863f1491d911a04. This affects an unknown part of the file /index.php/api/product/set of the component Hidden REST API Endpoint. This manipulation of the argument title/description causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Patch name: d9785f995da77bdc62fb2d34bad5f7a162c9ad23. To fix this issue, it is recommended to deploy a patch.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00486 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kirilkirkovEcommerce-CodeIgniter-Bootstrap49b20f5—No fix listedCNA
  • Ecommerce-CodeIgniter-Bootstrap Vendorkirilkirkov Affected 49b20f5 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:kirilkirkov:ecommerce-codeigniter-bootstrap:*:*:*:*:*:*:*:*——kirilkirkov
  • cpe:2.3:a:kirilkirkov:ecommerce-codeigniter-bootstrap:*:*:*:*:*:*:*:* Versions — — ·kirilkirkov

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-14633
  2. 2026-10-03 Alias added: GHSA-mc49-c33w-7xvv

References

Exploit 1

Patch 1

Other 1

  • TI-2026-12334 kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization CVSS 4.0HIGH 8.8
  • TI-2026-12332 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php path traversal CVSS 4.0MEDIUM 6.9
  • TI-2026-12331 Cross-site scripting in kirilkirkov Ecommerce-CodeIgniter-Bootstrap CVSS 4.0MEDIUM 5.3
  • TI-2026-12333 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_others_images path traversal CVSS 4.0MEDIUM 5.3
  • TI-2026-12329 kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect CVSS 4.0MEDIUM 5.3
  • TI-2026-01431 Missing authorization in kirilkirkov Invoct – PDF Invoices & Billing for WooCommerce CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences