CO
Vendor
codeigniter4
8
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-63223 | CO CodeIgniter4 codeigniter4 | 9.8 | Jul 31 | CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules |
| CVE-2026-63222 | CO CodeIgniter4 codeigniter4 | 7.5 | Jul 31 | CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames |
| CVE-2026-63221 | CO CodeIgniter4 codeigniter4 | 9.4 | Jul 31 | CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions |
| CVE-2026-63220 | CO CodeIgniter4 codeigniter4 | 4.8 | Jul 31 | CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() |
| CVE-2026-48062 | CO CodeIgniter4 codeigniter4 | 9.8 | Jul 17 | CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule |
| CVE-2025-54418 | CO CodeIgniter4 codeigniter4 | 9.8 | Jul 28 | CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability |
| CVE-2025-24013 | CO CodeIgniter4 codeigniter4 | 5.3 | Jan 20 | CodeIgniter validation of header name and value |
| CVE-2022-39284 | CO CodeIgniter4 codeigniter4 | 4.3 | Oct 6 | Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4 |