1226 matches found
CVE-2022-41446
CVE-2022-41446 Privilege Escalation in Teachers Record Management System using CodeIgnitor Suggested description An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to access and modify user data. Additional Information Proof Of...
CVE-2022-41445
CVE-2022-41445 Cross Site Scripting in Teacher's Record Management System using CodeIgnitor Suggested description A cross-site scripting XSS vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected int...
CVE-2022-38813
CVE-2022-38813 Veritical Privilege Escalation via user parameter in Blood Donor Management System Using Codeigniter v 1.0 Technical description: Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete t...
CVE-2022-40470
CVE-2022-40470 Cross Site Scripting in Blood Donor Management System Using CodeIgniter - 1.0 Suggested description Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature. Additional Information PoC:...
ASIS - SQL Injection Authentication Bypass
ASIS aka Aplikasi Sistem Sekolah using CodeIgniter 3 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass. id: CVE-2024-45622 info: name: ASIS - SQL Injection Authentication Bypass author: s4e-io severity: critical description: | ASIS aka Aplikasi Sistem Sekolah...
CVE-2026-63223
CVE-2026-63223 — CodeIgniter 4 File Upload RCE Magic Bytes Bypass → isimage/mimein → PHP Webshell → RCE Overview CVE-2026-63223 is a critical-severity CVSS 9.8 unauthenticated remote code execution vulnerability in CodeIgniter 4 , a PHP full-stack web framework, affecting versions prior to 4.7.4...
CVE-2023-32692-CodeIgniter4
CVE-2023-32692 — CodeIgniter 4 Validation Rule Injection CVE-2023-32692 is a code injection vulnerability in the CodeIgniter 4 PHP framework, affecting versions 4.0.0 through 4.3.4. It was fixed in 4.3.5 released June 2023. This is a demo environment for anyone that wants to play with it...
CVE-2026-63223-POC
CVE-2026-63223 PoC — CodeIgniter 4 File Upload RCE CVSS 9.8 Critical | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-434 : Unrestricted Upload of File with Dangerous Type Fixed : CodeIgniter 4 v4.7.4 Advisory : GHSA-mmj4-63m4-r6h5 Vulnerability Summary CodeIgniter 4's isimage and mimein file upload...
CodeIgniterXor
CodeIgniterXor PoC script to decode CodeIgniter = 2.1.4 session cookies that use xorencode method. Full details availalbe on on the following blog post: https://www.dionach.com/blog/codeigniter-session-decoding-vulnerability Usage break.py This is the main script, and given a target URI will...
EasyAppointments 1.5.1 - Blind SQL Injection
Exploit Title: EasyAppointments 1.5.1 - Blind SQL Injection Google Dork: N/A backend login required Date: 07/27/2026 Exploit Author: Michael Chesang Vendor Homepage: https://easyappointments.org Software Link: https://github.com/alextselegidis/easyappointments/releases Version: = 1.5.1 REQUIRED...
EasyAppointments 1.5.1 Blind SQL Injection
A blind SQL injection vulnerability exists in the orderby parameter of the /index.php/customers/search endpoint in EasyAppointments versions 1.5.1 and below. The parameter is passed unsanitized to CodeIgniter 3 Query Builder orderby. Parenthesized subqueries bypass backtick escaping via CI3's...
GHSA-MMJ4-63M4-R6H5 CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations. Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe extension check, such as extin on patched...
CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules
Impact This is an unsafe file upload validation vulnerability that can lead to remote code execution in vulnerable application configurations. Applications are impacted when they: - validate uploads using isimage or mimein without an independent safe extension check, such as extin on patched...
EUVD-2026-51399
CodeIgniter: Uploaded file extension validation bypass in isimage and mimein rules...
EUVD-2026-51398
CodeIgniter: Path traversal in UploadedFile::move when using client-provided filenames...
GHSA-HHMC-Q9HP-R662 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Impact In affected versions, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization. Depending on the destination path and server configuration, an attacker can supply a filename containing path traversal sequences e.g. ../../public/shell.php t...
EUVD-2026-51397
CodeIgniter: SQL injection in Query Builder deleteBatch when used with where conditions...
GHSA-C9W5-RWH3-7PM9 CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Impact A SQL injection vulnerability exists in the Query Builder's deleteBatch method. When deleteBatch is used together with where conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quote...
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Impact A SQL injection vulnerability exists in the Query Builder's deleteBatch method. When deleteBatch is used together with where conditions, the bound values from the WHERE clause are substituted directly into the generated SQL with their escape flag ignored, so they are never escaped or quote...