Security
فارسی
All products

codeigniter4/framework

Composer · Package
19 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` ruleCVE-2026-48062 · GHSA-2GR4-PPC7-7MHX codeigniter4/framework Composer Critical Fix reported
CodeIgniter4 DoS VulnerabilityCVE-2024-29904 · GHSA-39FP-MQMM-GXJ6 codeigniter4/framework Composer High Fix reported
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rulesCVE-2026-63223 · GHSA-MMJ4-63M4-R6H5 codeigniter4/framework Composer Critical Fix reported
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenamesCVE-2026-63222 · GHSA-HHMC-Q9HP-R662 codeigniter4/framework Composer High Fix reported
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditionsCVE-2026-63221 · GHSA-C9W5-RWH3-7PM9 codeigniter4/framework Composer Critical Fix reported
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()CVE-2026-63220 · GHSA-7WMF-PW8J-MC78 codeigniter4/framework Composer Medium Fix reported
Missing validation of header name and value in codeigniter4/frameworkCVE-2025-24013 · GHSA-X5MQ-JJR3-VMX6 codeigniter4/framework Composer Medium Fix reported
CodeIgniter4's ImageMagick Handler has Command Injection VulnerabilityCVE-2025-54418 · GHSA-9952-GV64-X94C codeigniter4/framework Composer Critical Fix reported
CodeIgniter HTTP Header InjectionCVE-2017-1000247 · GHSA-J9F9-8J39-4G97 codeigniter4/framework Composer High Fix reported
CodeIgniter Improper Privilege ManagementCVE-2020-10793 · GHSA-JWQP-WH5G-4GMM codeigniter4/framework Composer High No fix reported
Deserialization of Untrusted Data in Codeigniter4CVE-2022-21647 · GHSA-W6JR-WJ64-MC9X codeigniter4/framework Composer High Fix reported
Remote CLI Command Execution Vulnerability in CodeIgniter4CVE-2022-24711 · GHSA-XJP4-6W75-QRJ7 codeigniter4/framework Composer Critical Fix reported
Cross-site Scripting Vulnerability in CodeIgniter4CVE-2022-21715 · GHSA-7528-7JG5-6G62 codeigniter4/framework Composer Medium Fix reported
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4CVE-2023-32692 · GHSA-M6M8-6GQ8-C9FJ codeigniter4/framework Composer Critical Fix reported
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment CVE-2023-46240 · GHSA-HWXF-QXJ7-7RFJ codeigniter4/framework Composer High Fix reported
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issuedCVE-2022-39284 · GHSA-745P-R637-7VVP codeigniter4/framework Composer Low Fix reported
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4CVE-2022-24712 · GHSA-4V37-24GM-H554 codeigniter4/framework Composer Medium Fix reported
CodeIgniter4 allows spoofing of IP address when using proxyCVE-2022-23556 · GHSA-GHW3-5QVM-3MQC codeigniter4/framework Composer High Fix reported
CodeIgniter4 Potential Session Handlers VulnerabilityCVE-2022-46170 · GHSA-6CQ5-8CJ7-G558 codeigniter4/framework Composer High Fix reported