Skip to content
OpenAdvisories

Vendor

codeigniter4

21 known vulnerabilities.

Products

CodeIgniter4 17 shield 4
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-63222

    CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

    CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move() without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content …

    codeigniter4 CodeIgniter4 codeigniter4/framework php-codeigniter-framework Ubuntu Packagist
  • High 7.5
    CVE-2024-29904

    CodeIgniter4 Language class DoS Vulnerability

    CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacker to consume a large amount of memory on the server. Upgrade to v4.4.7 or later.

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • High 7.5
    CVE-2023-46240

    CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

    CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • High 7.5
    CVE-2023-27580

    CodeIgniter Shield Password Shucking Vulnerability

    CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than exp…

    codeigniter4 shield codeigniter4/shield Packagist
  • High 8.6
    CVE-2022-46170

    CodeIgniter is vulnerable to improper authentication via Session Handlers

    CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an at…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • High 7.0
    CVE-2022-23556

    CodeIgniter is vulnerable to IP address spoofing when using proxy

    CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$prox…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • High 7.7
    CVE-2022-21647 EPSS 38%

    Deserialization of Untrusted Data in Codeigniter4

    CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possibly execute existing…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist