CVE-2023-48708

CodeIgniter Shield (for CodeIgniter 4) contains a vulnerability where successful login attempts can store raw tokens in the log table. If logs are viewed, an attacker could obtain a token and misuse user authority. The issue is fixed in Shield v1.0.0-beta.8; upgrade is advised. If upgrading isn’t...

CVE-2023-48707

The CVE-2023-48707 entry concerns CodeIgniter Shield (CodeIgniter 4) where the secretKey used for HMAC SHA256 authentication was stored in cleartext in the database in affected versions. This plaintext storage enables an attacker with DB access to misuse the secretKey to impersonate users via HMA...