Ccodeigniter4

Products

Exploited and recent CVEs

• CVE-2026-63223 Critical 9.8 CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules 0.8%
• CVE-2026-63222 High 7.5 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames 0.6%
• CVE-2026-63221 Critical 9.4 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions 0.6%
• CVE-2026-63220 Medium 4.8 CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure() 0.2%
• CVE-2026-48062 Critical 9.8 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule 0.8%
• CVE-2025-54418 Critical 9.8 CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability 1.5%
• CVE-2025-24013 Medium 5.3 CodeIgniter validation of header name and value 0.5%
• CVE-2024-29904 High 7.5 CodeIgniter4 Language class DoS Vulnerability 0.8%
• CVE-2023-48707 Medium 5.0 Cleartext Storage of Sensitive Information in codeigniter4/shield 0.3%
• CVE-2023-48708 Medium 5.0 Insertion of Sensitive Information into Log in codeigniter4/shield 0.6%
• CVE-2023-46240 High 7.5 CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment 0.8%
• CVE-2023-32692 Critical 9.8 Remote Code Execution Vulnerability in Validation Placeholders 1.1%
• CVE-2023-27580 High 7.5 CodeIgniter Shield Password Shucking Vulnerability 0.5%
• CVE-2022-46170 High 8.6 CodeIgniter is vulnerable to improper authentication via Session Handlers 0.9%
• CVE-2022-23556 High 7.0 CodeIgniter is vulnerable to IP address spoofing when using proxy 0.4%
• CVE-2022-39284 Low 2.6 Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4 1.1%
• CVE-2022-35943 Medium 5.9 SameSite may allow cross-site request forgery (CSRF) protection to be bypassed 0.6%
• CVE-2022-24712 Medium 6.3 Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4 0.6%
• CVE-2022-24711 Critical 9.4 Remote CLI Command Execution Vulnerability in CodeIgniter4 1.2%
• CVE-2022-21715 Medium 5.4 Cross-site Scripting Vulnerability in CodeIgniter4 1.0%
• CVE-2022-21647 High 7.7 Deserialization of Untrusted Data in Codeigniter4 37.7%