CO
Product
Codeigniter
41
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 22High 8Medium 6Low 0
Watch
Add Codeigniter to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54418 | 9.8 | Jul 28 | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability Affected: 4.0.0 before 4.6.2 |
| CVE-2023-32692 | 9.8 | May 30 | CodeIgniter is a PHP full-stack web framework Affected: before 4.3.5 |
| CVE-2022-46170 | 9.8 | Dec 22 | CodeIgniter is a PHP full-stack web framework Affected: 4.0.0 before 4.2.11 |
| CVE-2022-40834 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40824 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40825 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40826 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40827 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40828 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40829 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40830 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40831 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40832 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40833 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-40835 | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a… Affected: 3.0 through 3.1.13; 3.0; 3.0; 3.0; 3.0 |
| CVE-2022-24711 | 9.8 | Feb 28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework Affected: 4.0.0 before 4.1.9 |
| CVE-2022-21647 | 9.8 | Jan 4 | CodeIgniter is an open source PHP full-stack web framework Affected: 4.0.0 before 4.1.6 |
| CVE-2018-12071 | 9.8 | Jun 17 | A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled Affected: before 3.1.9 |
| CVE-2015-5725 | 9.8 | Feb 21 | SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors… Affected: before 2.2.4 |
| CVE-2014-8686 | 9.8 | Sep 19 | CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP… Affected: through 2.1.4 |
| CVE-2014-8684 | 9.8 | Sep 19 | CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object… Affected: through 2.2.6 |
| CVE-2016-10131 | 9.8 | Jan 12 | system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail… Affected: through 3.1.2 |
Showing 22