Vulnerabilities

TI-2025-34224 CVE-2025-54418 · GHSA-9952-gv64-x94c

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

MEDIUM 46

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01503 Published 2025-07-28 Fixed in 4.6.2 CWE-78

TI-2025-17780 CVE-2025-24013 · GHSA-x5mq-jjr3-vmx6

CodeIgniter validation of header name and value

LOW 31

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00508 Published 2025-01-20 Fixed in 4.5.8 CWE-436

TI-2024-27591 CVE-2024-41344 · GHSA-2hwf-hm8p-fc5c

A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily…

HIGH 68

A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0023 Published 2024-10-15 No fix listed CWE-352

TI-2024-19671 CVE-2024-29904 · GHSA-39fp-mqmm-gxj6

CodeIgniter4 Language class DoS Vulnerability

HIGH 66

CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00773 Published 2024-03-29 Fixed in 4.4.7 CWE-835

TI-2023-24867 CVE-2023-46240 · GHSA-hwxf-qxj7-7rfj

CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

MEDIUM 40

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00777 Published 2023-10-31 Fixed in 4.4.3 CWE-209

TI-2023-15968 CVE-2023-32692 · GHSA-m6m8-6gq8-c9fj

Remote Code Execution Vulnerability in Validation Placeholders

MEDIUM 51

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01126 Published 2023-05-30 Fixed in 4.3.5 CWE-94

TI-2022-22814 CVE-2022-46170 · GHSA-6cq5-8cj7-g558

CodeIgniter is vulnerable to improper authentication via Session Handlers

MEDIUM 50

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00912 Published 2022-12-22 Fixed in 4.2.11 CWE-287

TI-2022-07609 CVE-2022-23556 · GHSA-ghw3-5qvm-3mqc

CodeIgniter is vulnerable to IP address spoofing when using proxy

LOW 33

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00398 Published 2022-12-22 Fixed in 4.2.11 CWE-345

TI-2022-19429 CVE-2022-40835 · GHSA-6646-39mj-h9x4

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19428 CVE-2022-40834 · GHSA-qg28-mpvr-p3rx

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19427 CVE-2022-40833 · GHSA-7x5f-444r-jc46

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19426 CVE-2022-40832 · GHSA-hj3j-f78g-wj29

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19425 CVE-2022-40831 · GHSA-2m9w-pj9w-w243

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19424 CVE-2022-40830 · GHSA-8vpr-6j25-gxcc

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19423 CVE-2022-40829 · GHSA-8j68-m69v-7x9f

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19422 CVE-2022-40828 · GHSA-3mpc-949c-h3m6

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19421 CVE-2022-40827 · GHSA-jv9q-9872-3fqh

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01042 Published 2022-10-07 No fix listed CWE-89

TI-2022-19420 CVE-2022-40826 · GHSA-cjcg-hc25-x29f

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19419 CVE-2022-40825 · GHSA-vx2g-v3f9-m6mw

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19418 CVE-2022-40824 · GHSA-6x3c-285p-52r4

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-18660 CVE-2022-39284 · GHSA-745p-r637-7vvp

Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4

MEDIUM 53

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.01122 Published 2022-10-06 Fixed in 4.2.7 CWE-665

TI-2022-16370 CVE-2022-35943 · GHSA-5hm8-vh6r-2cjq

SameSite may allow cross-site request forgery (CSRF) protection to be bypassed

HIGH 71

Shield is an authentication and authorization framework for CodeIgniter 4.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00611 Published 2022-08-12 Fixed in 1.0.0-beta.2 CWE-352

TI-2022-08527 CVE-2022-24712 · GHSA-4v37-24gm-h554

Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4

LOW 39

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00565 Published 2022-02-28 Fixed in 4.1.9 CWE-352

TI-2022-08526 CVE-2022-24711 · GHSA-xjp4-6w75-qrj7

Remote CLI Command Execution Vulnerability in CodeIgniter4

MEDIUM 50

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01173 Published 2022-02-28 Fixed in 4.1.9 CWE-20

TI-2022-06089 CVE-2022-21715 · GHSA-7528-7jg5-6g62

Cross-site Scripting Vulnerability in CodeIgniter4

LOW 29

CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01002 Published 2022-01-24 Fixed in 4.1.8 CWE-79

Vulnerabilities

Filters