{"kind": "product", "path": "vulns/packagist/codeigniter4%2Fframework", "name": "codeigniter4/framework", "product": "codeigniter4/framework", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-63223", "noindex": false, "published": "2026-07-31T04:10:28.179Z", "modified": "2026-07-31T23:16:24.574Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.008, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-63223", "title": "CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules", "description": "CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the is_image and mime_in upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads in a web-accessible script-enabled directory. Applications are impacted when they validate uploads using is_image or mime_in without an independent safe extension check (such as ext_in on patched versions), save uploaded files using the client-supplied filename, and place uploads in a web-accessible directory where PHP files can execute. This issue", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-mmj4-63m4-r6h5", "https://github.com/codeigniter4/CodeIgniter4/commit/b6e9a4fa1dca2df3d3f261bdf61532df8c6420aa", "https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4"], "fixes": ["4.7.4"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-63222", "noindex": false, "published": "2026-07-31T04:06:19.448Z", "modified": "2026-07-31T15:58:43.539Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "severity": "high", "epss": 0.00635, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-63222", "title": "CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames", "description": "CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the application exposes an upload path. This issue is fixed in version 4.7.4.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hhmc-q9hp-r662", "https://github.com/codeigniter4/CodeIgniter4/commit/20ebcf4694d96d3c97fbc3938e360730e4f54618", "https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4"], "fixes": ["4.7.4"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-63221", "noindex": false, "published": "2026-07-31T04:03:34.352Z", "modified": "2026-07-31T13:52:40.376Z", "cvss": 9.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "severity": "critical", "epss": 0.00612, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-63221", "title": "CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions", "description": "CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9", "https://github.com/codeigniter4/CodeIgniter4/commit/f5e463b9a3e986389ce285963e51a7f1fab6559f", "https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4"], "fixes": ["4.7.4"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-63220", "noindex": false, "published": "2026-07-31T03:50:27.294Z", "modified": "2026-07-31T13:58:31.522Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00168, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-63220", "title": "CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()", "description": "CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request as secure. This may have impacted applications that rely on isSecure(), force_https(), forceGlobalSecureRequests, or similar logic to enforce HTTPS-only access or make security-sensitive decisions. Exploitability depends on deployment configuration. Applications are most exposed if the backend is reachable directly over HTTP, or if a reverse proxy/lo", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7wmf-pw8j-mc78", "https://github.com/codeigniter4/CodeIgniter4/commit/ecbf044666bed41d23f07518096d9843fe6c08b0", "https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4"], "fixes": ["4.7.4"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-48062", "noindex": false, "published": "2026-07-17T20:36:29.676Z", "modified": "2026-07-20T13:47:15.742Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.00775, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-48062", "title": "CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule", "description": "CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the ext_in upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing GIF-like content could pass validation such as uploaded[avatar]|is_image[avatar]|mime_in[avatar,image/gif]|ext_in[avatar,gif] because the detected MIME type maps to gif, even though the uploaded filename extension is php. Applications are impacted if they accept user-controlled uploads, rely on ext_in to validate the uploaded filename extension, save up", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-2gr4-ppc7-7mhx", "https://github.com/codeigniter4/CodeIgniter4/commit/29299349e7d232e9532767c7cefaed30957309be", "https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.3"], "fixes": ["4.7.3"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-54418", "noindex": false, "published": "2025-07-28T14:47:20.887Z", "modified": "2025-07-28T17:19:14.503Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.01531, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-54418", "title": "CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability", "description": "CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing (`imagick` as the image library) and either allow file uploads with user-controlled filenames and process uploaded images using the `resize()` method or use the `text()` method with user-controlled text content or options. An attacker can upload a file with a malicious filename containing shell metacharacters that get executed when the image is processed or provide malicious text content or options that get executed when adding text to images Users should", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-9952-gv64-x94c", "https://github.com/codeigniter4/CodeIgniter4/commit/e18120bff1da691e1d15ffc1bf553ae7411762c0", "https://cwe.mitre.org/data/definitions/78.html"], "fixes": ["4.6.2"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-24013", "noindex": false, "published": "2025-01-20T15:57:37.975Z", "modified": "2025-01-21T14:51:01.754Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.00508, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-24013", "title": "CodeIgniter validation of header name and value", "description": "CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functionality, potentially causing errors or generating invalid HTTP requests. In some cases, these malformed requests might lead to a DoS scenario if a remote service’s web application firewall interprets them as malicious and blocks further communication with the application. This vulnerability is fixed in 4.5.8.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-x5mq-jjr3-vmx6", "https://github.com/codeigniter4/CodeIgniter4/commit/5f8aa24280fb09947897d6b322bf1f0e038b13b6", "https://datatracker.ietf.org/doc/html/rfc7230#section-3.2"], "fixes": ["4.5.8"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-29904", "noindex": false, "published": "2024-03-29T15:32:38.686Z", "modified": "2024-08-21T22:44:16.609Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00773, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-29904", "title": "CodeIgniter4 Language class DoS Vulnerability", "description": "CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later. \n", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-39fp-mqmm-gxj6", "https://github.com/codeigniter4/CodeIgniter4/commit/fa851acbae7ae4c5a97f8f38ae87aa0822a334c0", "https://nvd.nist.gov/vuln/detail/CVE-2024-29904"], "fixes": ["4.4.7"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-46240", "noindex": false, "published": "2023-10-31T15:03:51.798Z", "modified": "2024-09-05T17:36:02.600Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "severity": "high", "epss": 0.00621, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-46240", "title": "CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment", "description": "CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hwxf-qxj7-7rfj", "https://github.com/codeigniter4/CodeIgniter4/commit/423569fc31e29f51635a2e59c89770333f0e7563", "https://codeigniter4.github.io/userguide/general/errors.html#error-reporting"], "fixes": ["4.4.3"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2023-32692", "noindex": false, "published": "2023-05-30T03:15:01.363Z", "modified": "2025-01-10T20:38:42.898Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.01126, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2023-32692", "title": "Remote Code Execution Vulnerability in Validation Placeholders", "description": "CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5.\n", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj", "https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md", "https://nvd.nist.gov/vuln/detail/CVE-2023-32692"], "fixes": ["4.3.5"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-46170", "noindex": false, "published": "2022-12-22T18:58:17.658Z", "modified": "2025-04-15T14:33:06.620Z", "cvss": 8.6, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "severity": "high", "epss": 0.00912, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-46170", "title": "CodeIgniter is vulnerable to improper authentication via Session Handlers", "description": "CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)  a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558", "https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328", "https://nvd.nist.gov/vuln/detail/CVE-2022-46170"], "fixes": ["4.2.11"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-23556", "noindex": false, "published": "2022-12-22T18:50:55.443Z", "modified": "2025-04-15T14:37:02.216Z", "cvss": 7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "severity": "high", "epss": 0.00398, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-23556", "title": "CodeIgniter is vulnerable to IP address spoofing when using proxy", "description": "CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.\n", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-ghw3-5qvm-3mqc", "https://github.com/codeigniter4/CodeIgniter4/commit/5ca8c99b2db09a2a08a013836628028ddc984659", "https://nvd.nist.gov/vuln/detail/CVE-2022-23556"], "fixes": ["4.2.11"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-39284", "noindex": false, "published": "2022-10-06T00:00:00.000Z", "modified": "2025-04-22T17:19:34.229Z", "cvss": 2.6, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.01122, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-39284", "title": "Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued in Codeigniter4", "description": "CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`. As a result cookie values are erroneously exposed to scripts. It should be noted that this vulnerability does not affect session cookies. Users are advised to upgrade to v4.2.7 or later. Users unable to upgrade are advised to manually construct their cookies either by setting the options in code or by constructing Cookie objects. Examples of each workaround are available in the linked GHSA.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-745p-r637-7vvp", "https://github.com/codeigniter4/CodeIgniter4/issues/6540", "https://github.com/codeigniter4/CodeIgniter4/pull/6544"], "fixes": ["4.2.7"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-24712", "noindex": false, "published": "2022-02-28T16:00:12.000Z", "modified": "2025-04-23T19:00:10.052Z", "cvss": 6.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L", "severity": "medium", "epss": 0.00565, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-24712", "title": "Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4", "description": "CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. There are workarounds for this vulnerability, but users will still need to code as these after upgrading to v4.1.9. Otherwise, the CSRF protection may be bypassed. If auto-routing is enabled, check the request method in the controller method before processing. If auto-routing is disabled, either avoid using `$routes->add()` and instead use HTTP verbs in routes; or check the ", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-4v37-24gm-h554", "https://github.com/codeigniter4/CodeIgniter4/blob/7dc2ece32401ebde67122f7d2460efcaee7c352e/user_guide_src/source/changelogs/v4.1.9.rst", "https://nvd.nist.gov/vuln/detail/CVE-2022-24712"], "fixes": ["4.1.9"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-24711", "noindex": false, "published": "2022-02-28T15:45:11.000Z", "modified": "2025-04-23T19:00:16.255Z", "cvss": 9.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "severity": "critical", "epss": 0.01173, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-24711", "title": "Remote CLI Command Execution Vulnerability in CodeIgniter4", "description": "CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attackers to execute CLI routes via HTTP request. Version 4.1.9 contains a patch. There are currently no known workarounds for this vulnerability.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-xjp4-6w75-qrj7", "https://github.com/codeigniter4/CodeIgniter4/commit/202f41ad522ba1d414b9d9c35aba1cb0c156b781", "https://nvd.nist.gov/vuln/detail/CVE-2022-24711"], "fixes": ["4.1.9"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-21715", "noindex": false, "published": "2022-01-24T19:55:10.000Z", "modified": "2025-04-23T19:09:30.971Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.01002, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-21715", "title": "Cross-site Scripting Vulnerability in CodeIgniter4", "description": "CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API\\ResponseTrait`. Version 4.1.8 contains a patch for this vulnerability. There are two potential workarounds available. Users may avoid using `API\\ResponseTrait` or `ResourceController` Users may also disable Auto Route and use defined routes only.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-7528-7jg5-6g62", "https://github.com/codeigniter4/CodeIgniter4/commit/70d881cf5322b7c32e69516aebd2273ac6a1e8dd", "https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only"], "fixes": ["4.1.8"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2022-21647", "noindex": false, "published": "2022-01-04T20:05:11.000Z", "modified": "2025-04-23T19:14:59.823Z", "cvss": 7.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H", "severity": "high", "epss": 0.37671, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2022-21647", "title": "Deserialization of Untrusted Data in Codeigniter4", "description": "CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing PHP code on the server. We are aware of a working exploit, which can lead to SQL injection. Users are advised to upgrade to v4.1.6 or later. Users unable to upgrade as advised to not use the `old()` function and form_helper nor `RedirectResponse::withInput()` and `redirect()->withInput()`.", "references": ["https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-w6jr-wj64-mc9x", "https://github.com/codeigniter4/CodeIgniter4/commit/ce95ed5765256e2f09f3513e7d42790e0d6948f5", "https://nvd.nist.gov/vuln/detail/CVE-2022-21647"], "fixes": ["4.1.6"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2020-10793", "noindex": false, "published": "2020-03-23T14:12:20.000Z", "modified": "2024-08-04T11:14:15.590Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.01898, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2020-10793", "title": "CVE-2020-10793", "description": "CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the \"Select Role of the User\" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter", "references": ["https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeigniter-framework-ca30741ad297", "https://codeigniter4.github.io/userguide/extending/authentication.html", "https://nvd.nist.gov/vuln/detail/CVE-2020-10793"], "fixes": [], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}, {"id": "CVE-2017-1000247", "noindex": false, "published": "2017-11-17T04:00:00.000Z", "modified": "2024-09-17T01:10:53.370Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.00931, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2017-1000247", "title": "CVE-2017-1000247", "description": "British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws.", "references": ["https://www.codeigniter.com/userguide3/changelog.html#version-3-1-4", "https://nvd.nist.gov/vuln/detail/CVE-2017-1000247"], "fixes": ["3.1.4"], "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}]}], "total": 19, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "codeigniter4/framework", "path": "vulns/packagist/codeigniter4%2Fframework", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-31T23:16:24.574Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}