Vulnerabilities matching "codeigniter" — 54 matching vulnerabilities

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed — no installation and no source-code access required.

Scan your app free →

Severity	Vulnerability	Package	Ecosystem	Disclosed	Fixed version
9.8 critical	CVE-2026-63223: CodeIgniter Framework - Uploaded File Extension Validation Bypass	`codeigniter4/framework`	Packagist	07 Aug 2026	4.7.4
7.5 high	CVE-2026-63222: CodeIgniter Path Traversal Vulnerability in UploadedFile::move()	`codeigniter4/framework`	Packagist	07 Aug 2026	4.7.4
9.4 critical	CVE-2026-63221: CodeIgniter SQL Injection Vulnerability in deleteBatch() Method	`codeigniter4/framework`	Packagist	07 Aug 2026	4.7.4
4.8 medium	CVE-2026-63220: CodeIgniter Framework Spoofable Forwarded HTTPS Headers Vulnerability	`codeigniter4/framework`	Packagist	07 Aug 2026	4.7.4
9.8 critical	CVE-2026-48062: CodeIgniter4 Validation Bypass in File Uploads	`codeigniter4/framework`	Packagist	11 Jun 2026	4.7.3
9.8 critical	CVE-2025-54418: CodeIgniter4 ImageMagick Handler Command Injection Vulnerability	`codeigniter4/framework`	Packagist	28 Jul 2025	4.6.2
6.1 medium	Cross-Site Scripting Vulnerability in CodeIgniter4 Framework	`codeigniter4/framework`	Packagist	25 Jul 2025	No fix published
5.3 medium	CVE-2025-24013: CodeIgniter4 Framework Header Validation Vulnerability	`codeigniter4/framework`	Packagist	21 Jan 2025	4.5.8
10.0 critical	SQL Injection Vulnerability in CodeIgniter Framework	`codeigniter/framework`	Packagist	15 May 2024	3.1.0
4.7 medium	Inadequate XSS Prevention in CodeIgniter/Framework Security Library	`codeigniter/framework`	Packagist	15 May 2024	3.0.3
7.5 high	CVE-2024-29904: CodeIgniter4 DoS Vulnerability	`codeigniter4/framework`	Packagist	29 Mar 2024	4.4.7
High	CVE-2020-10793: CodeIgniter Privilege Escalation	`codeigniter`	Bitnami	06 Mar 2024	4.0.0
Critical	CVE-2022-21647: CodeIgniter Deserialization of Untrusted Data	`codeigniter`	Bitnami	06 Mar 2024	4.1.6
Medium	CVE-2022-21715: CodeIgniter4 XSS Vulnerability	`codeigniter`	Bitnami	06 Mar 2024	4.1.8
High	CVE-2022-23556: CodeIgniter - IP Spoofing Vulnerability	`codeigniter`	Bitnami	06 Mar 2024	4.2.11
Critical	CVE-2022-24711: CodeIgniter4 Improper Input Validation Vulnerability	`codeigniter`	Bitnami	06 Mar 2024	4.1.9
High	CVE-2022-24712: CodeIgniter4 Cross-Site Request Forgery (CSRF) Protection Bypass	`codeigniter`	Bitnami	06 Mar 2024	4.1.9
High	CVE-2022-35943: CodeIgniter - SameSite Attackers Bypass CSRF Protection	`codeigniter`	Bitnami	06 Mar 2024	4.2.3
Medium	CVE-2022-39284: CodeIgniter Cookie Misconfiguration	`codeigniter`	Bitnami	06 Mar 2024	4.2.7
Critical	CVE-2022-46170: CodeIgniter Multiple Session Cookie Vulnerability	`codeigniter`	Bitnami	06 Mar 2024	4.2.11

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →

Questions

Searching the database

How do I search for a CVE or a package?

Type a CVE id, package name, ecosystem or keyword into the search field. Results include the severity, the affected package, the ecosystem, the disclosure date and the fixed version.

Can I filter by severity or by whether a fix exists?

Yes. The filters on the left narrow the list to critical, high, medium or low vulnerabilities, to a single ecosystem, and to vulnerabilities that have a fix available or none yet.

What does "No fix published" mean?

No patched version has been released for that vulnerability yet. The vulnerability page still shows the affected range and any workaround that can reduce exposure in the meantime.