CVE-2026-63223

CVE-2026-63223 — CodeIgniter 4 Datei-Upload-RCE Magic-Bytes-Umgehung → isimage/mimein → PHP-Webshell → RCE Übersicht CVE-2026-63223 ist eine kritische CVSS 9.8 nicht authentifizierte Schwachstelle zur Remote-Codeausführung in CodeIgniter 4 , einem PHP-Webframework für Full-Stack-Anwendungen, die...

ASIS - SQL Injection Authentication Bypass

ASIS aka Aplikasi Sistem Sekolah using CodeIgniter 3 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass. id: CVE-2024-45622 info: name: ASIS - SQL Injection Authentication Bypass author: s4e-io severity: critical description: | ASIS aka Aplikasi Sistem Sekolah...

CVE-2026-63223-POC

CVE-2026-63223 PoC — RCE tramite upload di file in CodeIgniter 4 CVSS 9.8 Critico | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Upload senza restrizioni di file con tipo pericoloso Corretto in : CodeIgniter 4 v4.7.4 Avviso di sicurezza : GHSA-mmj4-63m4-r6h5 Riassunto della vulnerabilità Le rego...

CVE-2022-41446

CVE-2022-41446 Elevazione dei privilegi in Teachers Record Management System che utilizza CodeIgnitor Descrizione suggerita Un problema di controllo degli accessi in /Admin/dashboard.php del Record Management System che utilizza CodeIgniter v1.0 consente agli aggressori di accedere e modificare i...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — Injeção de Regra de Validação no CodeIgniter 4 CVE-2023-32692 é uma vulnerabilidade de injeção de código no framework PHP CodeIgniter 4, afetando as versões 4.0.0 até 4.3.4. Foi corrigida na versão 4.3.5 lançada em junho de 2023. Este é um ambiente de demonstração para quem quise...

CVE-2022-41445

CVE-2022-41445 CodeIgnitor का उपयोग करते हुए शिक्षक रिकॉर्ड प्रबंधन प्रणाली में क्रॉस-साइट स्क्रिप्टिंग सुझाया गया विवरण CodeIgniter 1.0 का उपयोग करते हुए रिकॉर्ड प्रबंधन प्रणाली में एक क्रॉस-साइट स्क्रिप्टिंग XSS भेद्यता हमलावरों को Add Subject पृष्ठ पर इंजेक्ट किए गए एक क्राफ्टेड पेलोड के माध्य...

CVE-2022-40470

CVE-2022-40470 Cross Site Scripting nel Blood Donor Management System Using CodeIgniter - 1.0 Descrizione suggerita Phpgurukul Blood Donor Management System 1.0 consente Cross Site Scripting tramite la funzione Aggiungi nome gruppo sanguigno. Informazioni aggiuntive PoC:...

CVE-2022-38813

CVE-2022-38813 Escalation verticale dei privilegi tramite il parametro utente in Blood Donor Management System Using Codeigniter v 1.0 Descrizione tecnica: Blood Donor Management System 1.0 non limita correttamente l'accesso a admin/dashboard.php, consentendo agli attaccanti di accedere a tutti i...

CodeIgniterXor

CodeIgniterXor PoC-Skript zum Dekodieren von CodeIgniter = 2.1.4 Session-Cookies, die die xorencode-Methode verwenden. Vollständige Details finden Sie im folgenden Blogbeitrag: https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability Verwendung break.py Dies ist das Hauptskript. We...

EUVD-2026-51399

CodeIgniter: Uploaded file extension validation bypass in isimage and mimein rules...

EUVD-2026-51398

CodeIgniter: Path traversal in UploadedFile::move when using client-provided filenames...

EUVD-2026-51397

CodeIgniter: SQL injection in Query Builder deleteBatch when used with where conditions...

EUVD-2026-51396

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...

SQL Injection

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to SQL Injection in the deleteBatch process when used with where conditions. An attacker can execute arbitrary SQL commands by supplying...

CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

UBUNTU-CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

UBUNTU-CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

UBUNTU-CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...