Vulnerabilities

TI-2026-45101 CVE-2026-63223 · GHSA-mmj4-63m4-r6h5

CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

MEDIUM 50

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.008 Published 2026-07-31 Fixed in 4.7.4 CWE-434

TI-2026-45100 CVE-2026-63222 · GHSA-hhmc-q9hp-r662

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

MEDIUM 40

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00635 Published 2026-07-31 Fixed in 4.7.4 CWE-22

TI-2026-45099 CVE-2026-63221 · GHSA-c9w5-rwh3-7pm9

CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

MEDIUM 47

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.00612 Published 2026-07-31 Fixed in 4.7.4 CWE-89

TI-2026-45098 CVE-2026-63220 · GHSA-7wmf-pw8j-mc78

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

LOW 21

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00168 Published 2026-07-31 Fixed in 4.7.4 CWE-348

TI-2026-35503 CVE-2026-48062 · GHSA-2gr4-ppc7-7mhx

CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

MEDIUM 50

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00775 Published 2026-07-17 Fixed in 4.7.3 CWE-434

TI-2025-34224 CVE-2025-54418 · GHSA-9952-gv64-x94c

CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

MEDIUM 46

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01503 Published 2025-07-28 Fixed in 4.6.2 CWE-78

TI-2025-17780 CVE-2025-24013 · GHSA-x5mq-jjr3-vmx6

CodeIgniter validation of header name and value

LOW 31

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00508 Published 2025-01-20 Fixed in 4.5.8 CWE-436

TI-2024-27591 CVE-2024-41344 · GHSA-2hwf-hm8p-fc5c

A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily…

HIGH 68

A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0023 Published 2024-10-15 No fix listed CWE-352

TI-2024-06052 CVE-2024-6526 · GHSA-5fc5-2cqx-72pm

CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting

MEDIUM 57

A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00519 Published 2024-07-05 No fix listed CWE-79

TI-2024-19671 CVE-2024-29904 · GHSA-39fp-mqmm-gxj6

CodeIgniter4 Language class DoS Vulnerability

HIGH 66

CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00773 Published 2024-03-29 Fixed in 4.4.7 CWE-835

TI-2023-26546 CVE-2023-48707 · GHSA-v427-c49j-8w6x

Cleartext Storage of Sensitive Information in codeigniter4/shield

LOW 29

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00284 Published 2023-11-24 Fixed in 1.0.0-beta.8 CWE-312

TI-2023-26547 CVE-2023-48708 · GHSA-j72f-h752-mx4w

Insertion of Sensitive Information into Log in codeigniter4/shield

LOW 30

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0063 Published 2023-11-24 Fixed in 1.0.0-beta.8 CWE-532

TI-2023-24867 CVE-2023-46240 · GHSA-hwxf-qxj7-7rfj

CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

MEDIUM 40

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00777 Published 2023-10-31 Fixed in 4.4.3 CWE-209

TI-2023-15968 CVE-2023-32692 · GHSA-m6m8-6gq8-c9fj

Remote Code Execution Vulnerability in Validation Placeholders

MEDIUM 51

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01126 Published 2023-05-30 Fixed in 4.3.5 CWE-94

TI-2023-12290 CVE-2023-27580 · GHSA-c5vj-f36q-p9vg

CodeIgniter Shield Password Shucking Vulnerability

LOW 39

CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00517 Published 2023-03-13 Fixed in 1.0.0-beta.4 CWE-916

TI-2022-22814 CVE-2022-46170 · GHSA-6cq5-8cj7-g558

CodeIgniter is vulnerable to improper authentication via Session Handlers

MEDIUM 50

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00912 Published 2022-12-22 Fixed in 4.2.11 CWE-287

TI-2022-07609 CVE-2022-23556 · GHSA-ghw3-5qvm-3mqc

CodeIgniter is vulnerable to IP address spoofing when using proxy

LOW 33

CodeIgniter is a PHP full-stack web framework.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00398 Published 2022-12-22 Fixed in 4.2.11 CWE-345

TI-2022-19429 CVE-2022-40835 · GHSA-6646-39mj-h9x4

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19428 CVE-2022-40834 · GHSA-qg28-mpvr-p3rx

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19427 CVE-2022-40833 · GHSA-7x5f-444r-jc46

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19426 CVE-2022-40832 · GHSA-hj3j-f78g-wj29

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19425 CVE-2022-40831 · GHSA-2m9w-pj9w-w243

B.C.

MEDIUM 44

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19424 CVE-2022-40830 · GHSA-8vpr-6j25-gxcc

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19423 CVE-2022-40829 · GHSA-8j68-m69v-7x9f

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

TI-2022-19422 CVE-2022-40828 · GHSA-3mpc-949c-h3m6

B.C.

MEDIUM 51

B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01091 Published 2022-10-07 No fix listed CWE-89

Vulnerabilities

Filters