CVE-2022-40470

CVE-2022-40470 Cross Site Scripting in Blood Donor Management System Using CodeIgniter - 1.0 Suggested description Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature. Additional Information PoC:...

CVE-2026-63223-POC

CVE-2026-63223 PoC — RCE mediante subida de archivos en CodeIgniter 4 CVSS 9.8 Crítico | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Subida sin restricciones de un archivo con tipo peligroso Corregido : CodeIgniter 4 v4.7.4 Aviso : GHSA-mmj4-63m4-r6h5 Resumen de la vulnerabilidad Las reglas de...

CVE-2022-41445

CVE-2022-41445 Cross Site Scripting en el Sistema de Gestión de Registros de Profesores usando CodeIgnitor Descripción sugerida Una vulnerabilidad de cross-site scripting XSS en el Sistema de Gestión de Registros que usa CodeIgniter 1.0 permite a los atacantes ejecutar scripts web arbitrarios o...

ASIS - SQL Injection Authentication Bypass

ASIS aka Aplikasi Sistem Sekolah using CodeIgniter 3 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass. id: CVE-2024-45622 info: name: ASIS - SQL Injection Authentication Bypass author: s4e-io severity: critical description: | ASIS aka Aplikasi Sistem Sekolah...

CVE-2022-38813

CVE-2022-38813 Escalada de privilegios vertical a través del parámetro user en Blood Donor Management System Using Codeigniter v 1.0 Descripción técnica: Blood Donor Management System 1.0 no restringe adecuadamente el acceso a admin/dashboard.php, lo que permite a los atacantes acceder a todos lo...

CVE-2022-41446

CVE-2022-41446 Privilege Escalation in Teachers Record Management System using CodeIgnitor Suggested description An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to access and modify user data. Additional Information Proof Of...

CVE-2026-63223

CVE-2026-63223 — RCE por Subida de Archivos en CodeIgniter 4 Bypass de Magic Bytes → isimage/mimein → Webshell PHP → RCE Resumen CVE-2026-63223 es una vulnerabilidad no autenticada de ejecución remota de código, de severidad crítica CVSS 9.8, en CodeIgniter 4 , un framework web PHP full-stack, qu...

CVE-2023-32692-CodeIgniter4

CVE-2023-32692 — Inyección de reglas de validación en CodeIgniter 4 CVE-2023-32692 es una vulnerabilidad de inyección de código en el framework PHP CodeIgniter 4, que afecta a las versiones 4.0.0 a 4.3.4. Se corrigió en 4.3.5 publicada en junio de 2023. Este es un entorno de demostración para...

CodeIgniterXor

CodeIgniterXor PoC script to decode CodeIgniter = 2.1.4 session cookies that use xorencode method. Full details availalbe on on the following blog post: https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability Uso break.py Este es el script principal; dado un URI de destino,...

EasyAppointments 1.5.1 - Blind SQL Injection

Exploit Title: EasyAppointments 1.5.1 - Blind SQL Injection Google Dork: N/A backend login required Date: 07/27/2026 Exploit Author: Michael Chesang Vendor Homepage: https://easyappointments.org Software Link: https://github.com/alextselegidis/easyappointments/releases Version: = 1.5.1 REQUIRED...

EasyAppointments 1.5.1 Blind SQL Injection

A blind SQL injection vulnerability exists in the orderby parameter of the /index.php/customers/search endpoint in EasyAppointments versions 1.5.1 and below. The parameter is passed unsanitized to CodeIgniter 3 Query Builder orderby. Parenthesized subqueries bypass backtick escaping via CI3's...

EUVD-2026-51399

CodeIgniter: Uploaded file extension validation bypass in isimage and mimein rules...

EUVD-2026-51398

CodeIgniter: Path traversal in UploadedFile::move when using client-provided filenames...

EUVD-2026-51397

CodeIgniter: SQL injection in Query Builder deleteBatch when used with where conditions...

EUVD-2026-51396

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...

SQL Injection

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to SQL Injection in the deleteBatch process when used with where conditions. An attacker can execute arbitrary SQL commands by supplying...

CVE-2026-63223

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, the isimage and mimein upload validation rules do not independently enforce a safe client filename extension, allowing a remote attacker to upload executable content when an application preserves the client filename and stores uploads...

CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

UBUNTU-CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...