Skip to content
OpenAdvisories

Vendor

codeigniter4

21 known vulnerabilities.

Products

CodeIgniter4 17 shield 4
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-63220

    CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()

    CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the applicatio…

    codeigniter4 CodeIgniter4 codeigniter4/framework php-codeigniter-framework Ubuntu Packagist
  • Medium 5.3
    CVE-2025-24013

    CodeIgniter validation of header name and value

    CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct deliberately malformed headers with Header class. This could disrupt application functional…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Medium 5.0
    CVE-2023-48707

    Cleartext Storage of Sensitive Information in codeigniter4/shield

    CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow…

    codeigniter4 shield codeigniter4/shield Packagist
  • Medium 5.0
    CVE-2023-48708

    Insertion of Sensitive Information into Log in codeigniter4/shield

    CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they c…

    codeigniter4 shield codeigniter4/shield Packagist
  • Medium 5.9
    CVE-2022-35943

    SameSite may allow cross-site request forgery (CSRF) protection to be bypassed

    Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/s…

    codeigniter4 shield codeigniter4/shield Packagist
  • Medium 6.3
    CVE-2022-24712

    Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4

    CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypass the CodeIgniter4 Cross-Site Request Forgery (CSRF) protection mechanism. Users should upgrade to v…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist
  • Medium 5.4
    CVE-2022-21715

    Cross-site Scripting Vulnerability in CodeIgniter4

    CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A cross-site scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4 prior to version 4.1.8. Attackers can do XSS attacks if a potential victim is using `API…

    codeigniter4 CodeIgniter4 codeigniter4/framework Packagist