CO
Vendor
Codeigniter
46
CVEs
0
On KEV
0
New 30D
Products
CO9.8
Codeigniter
Codeigniter
41 CVEs0 on KEV0 new
SH8.8
Shield
Codeigniter
4 CVEs0 on KEV0 new
EC6.1
Ecommerce-CodeIgniter-Bootstrap
CodeIgniter
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-54418 | CO Codeigniter Codeigniter | 9.8 | Jul 28 | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability |
| CVE-2025-24013 | CO Codeigniter Codeigniter | 5.3 | Jan 20 | CodeIgniter validation of header name and value |
| CVE-2024-41344 | CO Codeigniter Codeigniter | 7.5 | Oct 15 | A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges |
| CVE-2024-6526 | EC Ecommerce-CodeIgniter-Bootstrap CodeIgniter | 6.1 | Jul 5 | CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting |
| CVE-2024-29904 | CO Codeigniter Codeigniter | 7.5 | Mar 29 | CodeIgniter4 Language class DoS Vulnerability |
| CVE-2023-48707 | SH Shield Codeigniter | 6.5 | Nov 24 | Cleartext Storage of Sensitive Information in codeigniter4/shield |
| CVE-2023-48708 | SH Shield Codeigniter | 6.5 | Nov 24 | Insertion of Sensitive Information into Log in codeigniter4/shield |
| CVE-2023-46240 | CO Codeigniter Codeigniter | 7.5 | Oct 31 | CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment |
| CVE-2023-32692 | CO Codeigniter Codeigniter | 9.8 | May 30 | CodeIgniter is a PHP full-stack web framework |
| CVE-2023-27580 | SH Shield Codeigniter | 5.9 | Mar 13 | CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework |
| CVE-2022-46170 | CO Codeigniter Codeigniter | 9.8 | Dec 22 | CodeIgniter is a PHP full-stack web framework |
| CVE-2022-23556 | CO Codeigniter Codeigniter | 7.5 | Dec 22 | CodeIgniter is a PHP full-stack web framework |
| CVE-2022-40831 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have… |
| CVE-2022-40824 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have… |
| CVE-2022-40825 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have… |
| CVE-2022-40826 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have… |
| CVE-2022-40827 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have… |
| CVE-2022-40828 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties… |
| CVE-2022-40829 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have… |
| CVE-2022-40830 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties… |
| CVE-2022-40832 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have… |
| CVE-2022-40833 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have… |
| CVE-2022-40834 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have… |
| CVE-2022-40835 | CO Codeigniter Codeigniter | 9.8 | Oct 7 | B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a… |
| CVE-2022-39284 | CO Codeigniter Codeigniter | 4.3 | Oct 6 | Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4 |
| CVE-2022-35943 | CO Codeigniter Codeigniter | 8.8 | Aug 12 | Shield is an authentication and authorization framework for CodeIgniter 4 |
| CVE-2022-24712 | CO Codeigniter Codeigniter | 8.8 | Feb 28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework |
| CVE-2022-24711 | CO Codeigniter Codeigniter | 9.8 | Feb 28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework |
| CVE-2022-21715 | CO Codeigniter Codeigniter | 6.1 | Jan 24 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework |
| CVE-2022-21647 | CO Codeigniter Codeigniter | 9.8 | Jan 4 | CodeIgniter is an open source PHP full-stack web framework |
| CVE-2020-10793 | CO Codeigniter Codeigniter | 8.8 | Mar 23 | CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page |
| CVE-2012-1915 | CO Codeigniter Codeigniter | 6.1 | Jan 9 | EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks |
| CVE-2018-12071 | CO Codeigniter Codeigniter | 9.8 | Jun 17 | A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled |
| CVE-2015-5725 | CO Codeigniter Codeigniter | 9.8 | Feb 21 | SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors… |
| CVE-2013-4891 | CO Codeigniter Codeigniter | 6.1 | Feb 21 | The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an… |
| CVE-2017-1000247 | CO Codeigniter Codeigniter | 7.5 | Nov 17 | British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header… |
| CVE-2014-8686 | CO Codeigniter Codeigniter | 9.8 | Sep 19 | CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP… |
| CVE-2014-8684 | CO Codeigniter Codeigniter | 9.8 | Sep 19 | CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object… |
| CVE-2016-10131 | CO Codeigniter Codeigniter | 9.8 | Jan 12 | system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail… |
| CVE-2011-3719 | CO Codeigniter Codeigniter | – | Sep 23 | CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… |
| CVE-2007-3706 | CO Codeigniter Codeigniter | – | Jul 11 | The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demonstrated by a… |
| CVE-2007-3708 | CO Codeigniter Codeigniter | – | Jul 11 | Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2)… |
| CVE-2007-3709 | CO Codeigniter Codeigniter | – | Jul 11 | CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in an… |
| CVE-2007-3707 | CO Codeigniter Codeigniter | – | Jul 11 | Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitrary files via a |