Login Request a demo
CO
Product
CodeIgniter4
by codeigniter4 · last CVE Jul 31, 2026
8
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities8In the news0Timeline
Severity mix
Critical 4High 1Medium 3Low 0
Severity
All severities8Critical4High1Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add CodeIgniter4 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-63223
9.8
1%
Jul 31
CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules
Affected: < 4.7.4
CVE-2026-48062
9.8
1%
Jul 17
CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule
Affected: < 4.7.3
CVE-2025-54418
9.8
2%
Jul 28
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
Affected: < 4.6.2
CVE-2026-63221
9.4
1%
Jul 31
CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
Affected: >= 4.3.0, < 4.7.4
CVE-2026-63222
7.5
1%
Jul 31
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Affected: < 4.7.4
CVE-2025-24013
5.3
1%
Jan 20
CodeIgniter validation of header name and value
Affected: < 4.5.8
CVE-2026-63220
4.8
0%
Jul 31
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
Affected: < 4.7.4
CVE-2022-39284
4.3
1%
Oct 6
Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4
Affected: < 4.2.7
Showing 8