CVE-2025-54418 | Critical | 9.8 | 2025-07-28 | CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagi… |
CVE-2025-24013 | Medium | 5.3 | 2025-01-20 | CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can c… |
CVE-2024-41344 | High | 7.5 | 2024-10-15 | A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges. |
CVE-2024-6526 | Low | 3.5 | 2024-07-05 | A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This af… |
CVE-2024-29904 | High | 7.5 | 2024-03-29 | CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by… |
CVE-2023-48708 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw… |
CVE-2023-48707 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication… |
CVE-2023-46240 | High | 7.5 | 2023-10-31 | CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even… |
CVE-2023-32692 | Critical | 9.8 | 2023-05-30 | CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerab… |
CVE-2023-27580 | High | 7.5 | 2023-03-13 | CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage… |
CVE-2022-46170 | High | 8.6 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)… |
CVE-2022-23556 | High | 7.0 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This… |
CVE-2022-40835 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have di… |
CVE-2022-40834 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multipl… |
CVE-2022-40833 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multipl… |
CVE-2022-40832 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple thi… |
CVE-2022-40831 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third… |
CVE-2022-40830 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multip… |
CVE-2022-40829 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple th… |
CVE-2022-40828 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Mul… |
CVE-2022-40827 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple thir… |
CVE-2022-40826 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple… |
CVE-2022-40825 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple t… |
CVE-2022-40824 | Critical | 9.8 | 2022-10-07 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple t… |
CVE-2022-39284 | Low | 2.6 | 2022-10-06 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected… |
CVE-2022-35943 | Medium | 5.9 | 2022-08-12 | Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name… |
CVE-2022-24712 | Medium | 6.3 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypas… |
CVE-2022-24711 | Critical | 9.4 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attack… |
CVE-2022-21715 | Medium | 5.4 | 2022-01-24 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in C… |
CVE-2022-21647 | High | 7.7 | 2022-01-04 | CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attacke… |
CVE-2020-10793 | High | 8.8 | 2020-03-23 | CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the… |
CVE-2012-1915 | Medium | 6.1 | 2020-01-09 | EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks. |
CVE-2018-12071 | Critical | 9.8 | 2018-06-17 | A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled. |
CVE-2015-5725 | Critical | 9.8 | 2018-02-21 | SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL comman… |
CVE-2013-4891 | Medium | 6.1 | 2018-02-21 | The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XS… |
CVE-2017-1000247 | High | 7.5 | 2017-11-17 | British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resul… |
CVE-2014-8686 | Critical | 9.8 | 2017-09-19 | CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt… |
CVE-2014-8684 | Critical | 9.8 | 2017-09-19 | CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently condu… |
CVE-2016-10131 | Critical | 9.8 | 2017-01-12 | system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to in… |
CVE-2011-3719 | | | 2011-09-23 | CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error… |
CVE-2007-3709 | | | 2007-07-11 | CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF… |
CVE-2007-3708 | | | 2007-07-11 | Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fro… |
CVE-2007-3707 | | | 2007-07-11 | Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitra… |
CVE-2007-3706 | | | 2007-07-11 | The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as dem… |