Skip to content
OpenAdvisories

Package · Packagist

codeigniter4/framework

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-63220

    CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

    CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the applicatio…

    codeigniter4 CodeIgniter4 codeigniter4/framework php-codeigniter-framework Ubuntu Packagist
  • Medium 5.3
    CVE-2025-24013

    CodeIgniter validation of header name and value

    CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functional…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Medium 6.3
    CVE-2022-24712

    Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4

    CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to v…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Medium 5.4
    CVE-2022-21715

    Cross-site Scripting Vulnerability in CodeIgniter4

    CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist