CO
Product
Codeigniter
41
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 22High 8Medium 6Low 0
Watch
Add Codeigniter to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54418 | 9.8 | Jul 28 | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability Affected: 4.0.0 before 4.6.2 |
| CVE-2023-32692 | 9.8 | May 30 | CodeIgniter is a PHP full-stack web framework Affected: before 4.3.5 |
| CVE-2022-46170 | 9.8 | Dec 22 | CodeIgniter is a PHP full-stack web framework Affected: 4.0.0 before 4.2.11 |
| CVE-2022-40834 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40824 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40825 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40826 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40827 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40828 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40829 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40830 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40831 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40832 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40833 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40835 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-24711 | 9.8 | Feb 28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework Affected: 4.0.0 before 4.1.9 |
| CVE-2022-21647 | 9.8 | Jan 4 | CodeIgniter is an open source PHP full-stack web framework Affected: 4.0.0 before 4.1.6 |
| CVE-2018-12071 | 9.8 | Jun 17 | A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled Affected: before 3.1.9 |
| CVE-2015-5725 | 9.8 | Feb 21 | SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors… Affected: before 2.2.4 |
| CVE-2014-8686 | 9.8 | Sep 19 | CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP… Affected: through 2.1.4 |
| CVE-2014-8684 | 9.8 | Sep 19 | CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object… Affected: through 2.2.6 |
| CVE-2016-10131 | 9.8 | Jan 12 | system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail… Affected: through 3.1.2 |
| CVE-2022-35943 | 8.8 | Aug 12 | Shield is an authentication and authorization framework for CodeIgniter 4 Affected: before 4.2.3 |
| CVE-2022-24712 | 8.8 | Feb 28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework Affected: 4.0.0 before 4.1.9 |
| CVE-2020-10793 | 8.8 | Mar 23 | CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page Affected: through 4.0.0 |
| CVE-2024-41344 | 7.5 | Oct 15 | A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges Affected: 3.1.13 |
| CVE-2024-29904 | 7.5 | Mar 29 | CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks Affected: before 4.4.7 |
| CVE-2023-46240 | 7.5 | Oct 31 | CodeIgniter is a PHP full-stack web framework Affected: before 4.4.3 |
| CVE-2022-23556 | 7.5 | Dec 22 | CodeIgniter is a PHP full-stack web framework Affected: 4.0.0 before 4.2.11 |
| CVE-2017-1000247 | 7.5 | Nov 17 | British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header… Affected: 3.1.3 |
| CVE-2024-6526 | 6.1 | Jul 5 | CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting Affected: before 1b3da45 |
| CVE-2022-21715 | 6.1 | Jan 24 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework Affected: 4.0.0 before 4.1.8 |
| CVE-2012-1915 | 6.1 | Jan 9 | EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks Affected: before 2.1.2 |
| CVE-2013-4891 | 6.1 | Feb 21 | The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an… Affected: before 2.1.4 |
| CVE-2025-24013 | 5.3 | Jan 20 | CodeIgniter validation of header name and value Affected: before 4.5.8 |
| CVE-2022-39284 | 4.3 | Oct 6 | Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4 Affected: 4.0.0 before 4.2.7 |
| CVE-2011-3719 | – | Sep 23 | CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… Affected: 1.7.2 |
| CVE-2007-3709 | – | Jul 11 | CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in an… Affected: 1.5.3 |
| CVE-2007-3707 | – | Jul 11 | Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitrary files via a Affected: 1.5.3 |
| CVE-2007-3708 | – | Jul 11 | Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2)… Affected: 1.5.3 |
| CVE-2007-3706 | – | Jul 11 | The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demonstrated by a… Affected: 1.5.3 |
Showing 41