CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch substitutes bound values from where conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the...

PT-2026-66681

Name of the Vulnerable Software and Affected Versions CodeIgniter versions 4.3.0 through 4.7.3 Description In the Query Builder, the deleteBatch function substitutes bound values from where conditions into generated SQL while ignoring their escape flags. This allows user-controlled condition valu...