Linux Distros Unpatched Vulnerability : CVE-2026-63223

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filenam...

Linux Distros Unpatched Vulnerability : CVE-2026-63221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated...

Linux Distros Unpatched Vulnerability : CVE-2026-63220

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers...

PT-2026-66682

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.4 Description Calling the move function within the UploadedFile class without providing a second argument allows the application to use the client-provided filename without proper sanitization. This enables a...

PT-2026-66676

Name of the Vulnerable Software and Affected Versions CodeIgniter versions prior to 4.7.4 Description The IncomingRequest::isSecure function trusts the X-Forwarded-Proto and Front-End-Https headers from any incoming request. This allows an attacker to spoof these headers, leading the application ...

Linux Distros Unpatched Vulnerability : CVE-2026-63222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without...

CVE-2026-63223: Unrestricted Upload of File with Dangerous Type

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63221: Improper Neutralization of Special Elements used in an SQL Command

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-63222: Improper Limitation of a Pathname to a Restricted Directory

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

CVE-2026-63220: Use of Less Trusted Source

CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the application to incorrectly treat an HTTP request a...

PT-2026-66681

Name of the Vulnerable Software and Affected Versions CodeIgniter versions 4.3.0 through 4.7.3 Description In the Query Builder, the deleteBatch function substitutes bound values from where conditions into generated SQL while ignoring their escape flags. This allows user-controlled condition valu...

Default CodeIgniter Page Detection

Detects Default CodeIgniter Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Default CodeIgniter Page.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Default CodeIgniter Page Detection',...

CodeIgniter - Error Page Detection

CodeIgniter error debug are enabled. !/usr/bin/env python3 -- coding: utf-8 -- """CodeIgniter error debug are enabled.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CodeIgniter - Error Page Detection', 'description...

Codeigniter Application Installer Exposure Detection

Codeigniter Application is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Codeigniter Application is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from...

CVE-2025-50455

A blind SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments versions

CVE-2026-45270

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index ...

CVE-2026-45270 CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index ...

EUVD-2026-45951

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index ...

CVE-2026-45270 CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Pages backend module registers the htmlpurify validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages Home::index ...

CVE-2026-45139

Summary of CVE-2026-45139 (CI4MS Fileeditor) : The Fileeditor module fails to validate the source path extension for two destructive endpoints, deleteFileOrFolder and renameFile, allowing a backend user with file-editor permissions to delete or rename arbitrary files inside the project root (e.g....