CVE-2026-63223 | Critical | 9.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client file… |
CVE-2026-63222 | High | 7.5 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without… |
CVE-2026-63221 | Critical | 9.4 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into gene… |
CVE-2026-63220 | Medium | 4.8 | 2026-07-31 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https header… |
CVE-2026-48062 | Critical | 9.8 | 2026-07-17 | CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIM… |
CVE-2025-54418 | Critical | 9.8 | 2025-07-28 | CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagi… |
CVE-2025-24013 | Medium | 5.3 | 2025-01-20 | CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can c… |
CVE-2024-29904 | High | 7.5 | 2024-03-29 | CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by… |
CVE-2023-48708 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw… |
CVE-2023-48707 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication… |
CVE-2023-46240 | High | 7.5 | 2023-10-31 | CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even… |
CVE-2023-32692 | Critical | 9.8 | 2023-05-30 | CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerab… |
CVE-2023-27580 | High | 7.5 | 2023-03-13 | CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage… |
CVE-2022-46170 | High | 8.6 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)… |
CVE-2022-23556 | High | 7.0 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This… |
CVE-2022-39284 | Low | 2.6 | 2022-10-06 | CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected… |
CVE-2022-35943 | Medium | 5.9 | 2022-08-12 | Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name… |
CVE-2022-24712 | Medium | 6.3 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypas… |
CVE-2022-24711 | Critical | 9.4 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attack… |
CVE-2022-21715 | Medium | 5.4 | 2022-01-24 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in C… |
CVE-2022-21647 | High | 7.7 | 2022-01-04 | CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attacke… |