Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
codeigniter codeigniter vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2014-8686
CodeIgniter prior to 2.2.0 makes it easier for malicious users to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.
Codeigniter Codeigniter
1 EDB exploit
2 Articles
9.8
CVSSv3
CVE-2016-10131
system/libraries/Email.php in CodeIgniter prior to 3.1.3 allows remote malicious users to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.
Codeigniter Codeigniter
8.8
CVSSv3
CVE-2022-35943
Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechani...
Codeigniter Codeigniter
Codeigniter Shield 1.0.0
8.8
CVSSv3
CVE-2022-24712
CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions before 4.1.9 might allow remote malicious users to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to version 4.1.9. The...
Codeigniter Codeigniter
8.8
CVSSv3
CVE-2020-10793
CodeIgniter up to and including 4.0.0 allows remote malicious users to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furtherm...
Codeigniter Codeigniter
7.5
CVSSv3
CVE-2023-46240
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As...
Codeigniter Codeigniter
7.5
CVSSv3
CVE-2022-23556
CodeIgniter is a PHP full-stack web framework. This vulnerability may allow malicious users to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a wor...
Codeigniter Codeigniter
7.5
CVSSv3
CVE-2017-1000247
British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws.
Codeigniter Codeigniter 3.1.3
6.5
CVSSv3
CVE-2023-48707
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the da...
Codeigniter Shield 1.0.0
6.5
CVSSv3
CVE-2023-48708
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token...
Codeigniter Shield 1.0.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-30310
CVE-2024-21683
CVE-2024-22187
chrome
deserialization
XPath injection
CVE-2024-27842
denial of service
CVE-2024-24851
google
CVE-2024-35400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »