Critical
CVE-2026-63223
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 21
Reset filters
High
CVE-2026-63222
CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames
Critical
CVE-2026-63221
CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions
Medium
CVE-2026-63220
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
Critical
CVE-2026-48062
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
High
CVE-2026-45270
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Medium
CVE-2026-45138
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Critical
CVE-2025-54418
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
Medium
CVE-2025-24013
Missing validation of header name and value in codeigniter4/framework
High
CVE-2024-29904
CodeIgniter4 DoS Vulnerability
High
CVE-2023-46240
CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
Critical
CVE-2023-32692
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
High
CVE-2022-46170
CodeIgniter4 Potential Session Handlers Vulnerability
High
CVE-2022-23556
CodeIgniter4 allows spoofing of IP address when using proxy
Low
CVE-2022-39284
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued
High
CVE-2020-10793
CodeIgniter Improper Privilege Management
High
CVE-2017-1000247
CodeIgniter HTTP Header Injection
Medium
CVE-2022-24712
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
Critical
CVE-2022-24711
Remote CLI Command Execution Vulnerability in CodeIgniter4
Medium
CVE-2022-21715
Cross-site Scripting Vulnerability in CodeIgniter4
High
CVE-2022-21647
Deserialization of Untrusted Data in Codeigniter4
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.