30 matches found
EUVD-2026-51397
CodeIgniter: SQL injection in Query Builder deleteBatch when used with where conditions...
SQL Injection
Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to SQL Injection in the deleteBatch process when used with where conditions. An attacker can execute arbitrary SQL commands by supplying...
CVE-2026-63221
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-63221
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-63221
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-63221
CodeIgniter (PHP) 4.x contains a SQL injection in the Query Builder deleteBatch() path from 4.3.0–4.7.3. When used with where() conditions, deleteBatch() substitutes bound values into generated SQL and ignores escape flags, allowing user-controlled values to be interpreted as SQL. The issue does ...
CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-63221 CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
CVE-2026-63221: Improper Neutralization of Special Elements used in an SQL Command
CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...
PT-2026-66681
Name of the Vulnerable Software and Affected Versions CodeIgniter versions 4.3.0 through 4.7.3 Description In the Query Builder, the deleteBatch function substitutes bound values from where conditions into generated SQL while ignoring their escape flags. This allows user-controlled condition valu...
Linux Distros Unpatched Vulnerability : CVE-2026-63221
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated...
EUVD-2025-31176
Malicious code in bioql PyPI...
JeecgBoot Authorization Issues Vulnerability (CNVD-2025-23073)
JeecgBoot is an open source low-code development platform based on the code generator of Beijing National Torch Information Technology Co. A security vulnerability exists in JeecgBoot 3.8.2 and earlier versions, which stems from improper authorization of the ids parameter in the...
CVE-2025-10977
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The...
CVE-2025-10977
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The...
CVE-2025-10977 JeecgBoot deleteBatch improper authorization
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The...
CVE-2025-10977 JeecgBoot deleteBatch improper authorization
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The...
CVE-2025-10977
CVE-2025-10977 affects JeecgBoot up to version 3.8.2. Affected is an unknown function in the file /sys/tenant/deleteBatch where manipulation of the ids argument leads to improper authorization. The vulnerability can be exploited remotely and is described with high attack complexity; exploits are ...
CVE-2025-10977: Improper Authorization
A vulnerability was identified in JeecgBoot up to 3.8.2. Impacted is an unknown function of the file /sys/tenant/deleteBatch. The manipulation of the argument ids leads to improper authorization. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The...
JeecgBoot 授权问题漏洞
JeecgBoot is an open source low-code development platform based on the code generator of Beijing National Torch Information Technology Co. A security vulnerability exists in JeecgBoot 3.8.2 and earlier versions, which stems from improper authorization of the ids parameter in the...