SQL Injection

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to SQL Injection in the deleteBatch process when used with where conditions. An attacker can execute arbitrary SQL commands by supplying...

Linux Distros Unpatched Vulnerability : CVE-2026-63221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated...

PT-2026-66681

Name of the Vulnerable Software and Affected Versions CodeIgniter versions 4.3.0 through 4.7.3 Description In the Query Builder, the deleteBatch function substitutes bound values from where conditions into generated SQL while ignoring their escape flags. This allows user-controlled condition valu...

CVE-2025-8840 jshERP Endpoint deleteBatch improper authorization

A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclos...