1226 matches found
CVE-2016-10131
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...
Code injection
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...
CVE-2016-10131
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...
CVE-2016-10131
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...
CVE-2016-10131
CodeIgniter prior to 3.1.3 is affected by CVE-2016-10131 via the file system/libraries/Email.php: an attacker who can control the email->from field can insert sendmail command-line arguments, enabling remote arbitrary code execution. Affected component: system/libraries/Email.php in CodeIgnite...
CVE-2016-10131: Improper Neutralization of Special Elements in Output Used by a Downstream Component
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...
CodeIgniter: Vulnerable Javascript library
Hi @codeigniter, Description You are using a vulnerable Javascript library. One or more vulnerabilities were reported for this version of the Javascript library. Consult Attack details and Web References for more information about the affected library and the vulnerabilities that were reported...
FreeBSD : codeigniter -- multiple vulnerabilities (5e439ee7-d3bd-11e6-ae1b-002590263bf5)
The CodeIgniter changelog reports : Fixed a SQL injection in the 'odbc' database driver. Updated setrealpath Path Helper function to filter-out php:// wrapper inputs. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from th...
FreeBSD : codeigniter -- multiple vulnerabilities (496160d3-d3be-11e6-ae1b-002590263bf5)
The CodeIgniter changelog reports : Fixed a number of new vulnerabilities in Security Library method xssclean. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques...
NodCMS Installer Client-Side Cross Site Scripting
===================================================== Exploit Title : NodCMS Installer - Multiples Cross Site Web Vulnerability Date Discovered : 2016-11-10 Affected Products: NodCMS Installer - Content Management System Exploitation Technique: Remote Severity Level: Low Tested OS : Windows 10...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed a number of new vulnerabilities in Security Library method xssclean...
CodeIgniter: Link sanitation bypass in xss_clean()
Hi there, While researching a website that uses your framework xssclean function to sanitize user's input in comments, I was able to bypass it and could trigger XSS payloads using javascript links in allowed tags such as anchors. This could be achieved by using the new HTML5 standard entities suc...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed an SQL injection in the ‘odbc’ database driver. Updated setrealpath Path Helper function to filter-out php:// wrapper inputs...
FineCMS Enterprise Email Parameter SQL Injection Vulnerability
FineCMS is a small and medium-sized content management system based on PHP+MySql+CI framework. An SQL injection vulnerability exists in the email parameter of FineCMS Enterprise Edition, as the program fails to adequately filter the email parameter, allowing attackers to exploit the vulnerability...
CodeIgniter: Web Server Disclosure
I would like to report an exposure of your web server kindly browse https://www.codeigniter.com/.htaccess...
CodeIgniter框架内核设计缺陷可能导致任意代码执行
简要描述： 为准备乌云深圳沙龙，准备几个0day做案例。 官方承认这个问题，说明会发布补丁，但不愿承认这是个『漏洞』……不过也无所谓，反正是不是都没美刀 详细说明： CI在加载模板的时候，会调用 $this-load-view'templatename', $data; 内核中，查看view函数源码： /system/core/Loader.php public function view$view, $vars = array, $return = FALSE return $this-ciloadarray'ciview' = $view, 'civars' =...
FreeBSD : codeigniter -- multiple vulnerabilities (698403a7-803d-11e5-ab94-002590263bf5)
The CodeIgniter changelog reports : Fixed an XSS attack vector in Security Library method xssclean. Changed Config Library method baseurl to fallback to $SERVER'SERVERADDR' in order to avoid Host header injections. Changed CAPTCHA Helper to try to use the operating system's PRNG first...
codeigniter -- multiple vulnerabilities
The CodeIgniter changelog reports: Fixed an XSS attack vector in Security Library method xssclean. Changed Config Library method baseurl to fallback to $SERVER'SERVERADDR' in order to avoid Host header injections. Changed CAPTCHA Helper to try to use the operating system's PRNG first...
