Codeigniter (Codeigniter) - vulnerabilities (CVEs)

41 CVEs, 0 in the last 30 days, 137 known versions, newest CVE from 2025-07-28. Vendor: Codeigniter.

CVEs of Codeigniter

• CVE-2025-54418 - CVSS 9.8 (critical), 2025-07-28: CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the…
• CVE-2025-24013 - CVSS 5.3 (medium), 2025-01-20: CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can…
• CVE-2024-41344 - CVSS 7.5 (high), 2024-10-15: A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges.
• CVE-2024-6526 - CVSS 6.1 (medium), 2024-07-05: A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This…
• CVE-2024-29904 - CVSS 7.5 (high), 2024-03-29: CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by…
• CVE-2023-46240 - CVSS 7.5 (high), 2023-10-31: CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even…
• CVE-2023-32692 - CVSS 9.8 (critical), 2023-05-30: CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The…
• CVE-2022-46170 - CVSS 9.8 (critical), 2022-12-22: CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and…
• CVE-2022-23556 - CVSS 7.5 (high), 2022-12-22: CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy.…
• CVE-2022-40832 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple…
• CVE-2022-40835 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have…
• CVE-2022-40828 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note:…
• CVE-2022-40831 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple…
• CVE-2022-40834 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note:…
• CVE-2022-40827 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple…
• CVE-2022-40830 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note:…
• CVE-2022-40833 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note:…
• CVE-2022-40826 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple…
• CVE-2022-40829 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple…
• CVE-2022-40825 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple…
• CVE-2022-40824 - CVSS 9.8 (critical), 2022-10-07: B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple…
• CVE-2022-39284 - CVSS 4.3 (medium), 2022-10-06: CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected…
• CVE-2022-35943 - CVSS 8.8 (high), 2022-08-12: Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite…
• CVE-2022-24712 - CVSS 8.8 (high), 2022-02-28: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to…
• CVE-2022-24711 - CVSS 9.8 (critical), 2022-02-28: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows…
• CVE-2022-21715 - CVSS 6.1 (medium), 2022-01-24: CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in…
• CVE-2022-21647 - CVSS 9.8 (critical), 2022-01-04: CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote…
• CVE-2020-10793 - CVSS 8.8 (high), 2020-03-23: CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the…
• CVE-2012-1915 - CVSS 6.1 (medium), 2020-01-09: EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
• CVE-2018-12071 - CVSS 9.8 (critical), 2018-06-17: A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.
• CVE-2015-5725 - CVSS 9.8 (critical), 2018-02-21: SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL…
• CVE-2013-4891 - CVSS 6.1 (medium), 2018-02-21: The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting…
• CVE-2017-1000247 - CVSS 7.5 (high), 2017-11-17: British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache…
• CVE-2014-8686 - CVSS 9.8 (critical), 2017-09-19: CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the…
• CVE-2014-8684 - CVSS 9.8 (critical), 2017-09-19: CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently…
• CVE-2016-10131 - CVSS 9.8 (critical), 2017-01-12: system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to…
• CVE-2011-3719 - CVSS 5 (medium), 2011-09-23: CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error…
• CVE-2007-3708 - CVSS 4.3 (medium), 2007-07-11: Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1)…
• CVE-2007-3707 - CVSS 5 (medium), 2007-07-11: Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read…
• CVE-2007-3706 - CVSS 2.1 (low), 2007-07-11: The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as…
• CVE-2007-3709 - CVSS 5 (medium), 2007-07-11: CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF…