{"items":[{"id":"CVE-2026-63223","published":"2026-07-31T04:10:28.179Z","updated":"2026-07-31T23:16:24.574Z","title":"CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules","severity":"CRITICAL","score":9.8,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.008,"kevAdded":null,"exploit":false},{"id":"CVE-2026-63222","published":"2026-07-31T04:06:19.448Z","updated":"2026-07-31T15:58:43.539Z","title":"CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames","severity":"HIGH","score":7.5,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00635,"kevAdded":null,"exploit":false},{"id":"CVE-2026-63221","published":"2026-07-31T04:03:34.352Z","updated":"2026-07-31T13:52:40.376Z","title":"CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions","severity":"CRITICAL","score":9.4,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00612,"kevAdded":null,"exploit":false},{"id":"CVE-2026-63220","published":"2026-07-31T03:50:27.294Z","updated":"2026-07-31T13:58:31.522Z","title":"CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()","severity":"MEDIUM","score":4.8,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00168,"kevAdded":null,"exploit":false},{"id":"CVE-2026-48062","published":"2026-07-17T20:36:29.676Z","updated":"2026-07-20T13:47:15.742Z","title":"CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule","severity":"CRITICAL","score":9.8,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00775,"kevAdded":null,"exploit":false},{"id":"CVE-2025-54418","published":"2025-07-28T14:47:20.887Z","updated":"2025-07-28T17:19:14.503Z","title":"CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability","severity":"CRITICAL","score":9.8,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.01503,"kevAdded":null,"exploit":false},{"id":"CVE-2025-24013","published":"2025-01-20T15:57:37.975Z","updated":"2025-01-21T14:51:01.754Z","title":"CodeIgniter validation of header name and value","severity":"MEDIUM","score":5.3,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00508,"kevAdded":null,"exploit":false},{"id":"CVE-2024-29904","published":"2024-03-29T15:32:38.686Z","updated":"2024-08-21T22:44:16.609Z","title":"CodeIgniter4 Language class DoS Vulnerability","severity":"HIGH","score":7.5,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00773,"kevAdded":null,"exploit":true},{"id":"CVE-2023-46240","published":"2023-10-31T15:03:51.798Z","updated":"2024-09-05T17:36:02.600Z","title":"CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment","severity":"HIGH","score":7.5,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00777,"kevAdded":null,"exploit":false},{"id":"CVE-2023-32692","published":"2023-05-30T03:15:01.363Z","updated":"2025-01-10T20:38:42.898Z","title":"Remote Code Execution Vulnerability in Validation Placeholders","severity":"CRITICAL","score":9.8,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.01126,"kevAdded":null,"exploit":false},{"id":"CVE-2022-46170","published":"2022-12-22T18:58:17.658Z","updated":"2025-04-15T14:33:06.620Z","title":"CodeIgniter is vulnerable to improper authentication via Session Handlers","severity":"HIGH","score":8.6,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00912,"kevAdded":null,"exploit":false},{"id":"CVE-2022-23556","published":"2022-12-22T18:50:55.443Z","updated":"2025-04-15T14:37:02.216Z","title":"CodeIgniter is vulnerable to IP address spoofing when using proxy","severity":"HIGH","score":7,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00398,"kevAdded":null,"exploit":false},{"id":"CVE-2022-39284","published":"2022-10-06T00:00:00.000Z","updated":"2025-04-22T17:19:34.229Z","title":"Secure or HttpOnly flag set in Config\\Cookie is not reflected in Cookies issued in Codeigniter4","severity":"LOW","score":2.6,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.01122,"kevAdded":null,"exploit":true},{"id":"CVE-2022-24712","published":"2022-02-28T16:00:12.000Z","updated":"2025-04-23T19:00:10.052Z","title":"Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4","severity":"MEDIUM","score":6.3,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.00565,"kevAdded":null,"exploit":false},{"id":"CVE-2022-24711","published":"2022-02-28T15:45:11.000Z","updated":"2025-04-23T19:00:16.255Z","title":"Remote CLI Command Execution Vulnerability in CodeIgniter4","severity":"CRITICAL","score":9.4,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.01173,"kevAdded":null,"exploit":false},{"id":"CVE-2022-21715","published":"2022-01-24T19:55:10.000Z","updated":"2025-04-23T19:09:30.971Z","title":"Cross-site Scripting Vulnerability in CodeIgniter4","severity":"MEDIUM","score":5.4,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.01002,"kevAdded":null,"exploit":false},{"id":"CVE-2022-21647","published":"2022-01-04T20:05:11.000Z","updated":"2025-04-23T19:14:59.823Z","title":"Deserialization of Untrusted Data in Codeigniter4","severity":"HIGH","score":7.7,"vendor":"codeigniter4","product":"CodeIgniter4","kev":false,"epss":0.37671,"kevAdded":null,"exploit":false}]}