Known vulnerabilities in CodeIgniter4

Software: CodeIgniter4
Software CPE: cpe:2.3:a:codeigniter:codeigniter4:*:*:*:*:*:*:*:*
Total vulnerabilities: 18
Public exploits: 1
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting CodeIgniter4 CodeIgniter4 is affected by 18 known vulnerabilities: 7 high, 8 medium, 3 low Critical High Medium Low

Vulnerabilities (18)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU137013 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-63222
CWE-22 Medium
No
No
4.7.4 07.07.2026 SB2026070756
#VU137012 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVE-2026-63221
CWE-89 High
No
No
4.7.4 07.07.2026 SB2026070756
#VU137011 - Use of Less Trusted Source
CVE-2026-63220
CWE-348 Medium
No
No
4.7.4 07.07.2026 SB2026070756
#VU137010 - Unrestricted Upload of File with Dangerous Type
CVE-2026-63223
CWE-434 High
Available
No
4.7.4 07.07.2026 SB2026070756
#VU132173 - Unrestricted Upload of File with Dangerous Type
CVE-2026-48062
CWE-434 High
No
No
4.7.3 23.05.2026 SB2026052302
#VU132172 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2025-54418
CWE-78 High
No
No
4.6.2 23.05.2026 SB2026052301
#VU132171 - Interpretation Conflict
CVE-2025-24013
CWE-436 Medium
No
No
4.5.8 18.01.2025 SB2025011811
#VU132170 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVE-2024-29904
CWE-835 Medium
No
No
4.4.7 29.03.2024 SB2024032959
#VU132169 - Information Exposure Through an Error Message
CVE-2023-46240
CWE-209 Medium
No
No
4.4.3 27.10.2023 SB2023102738
#VU132168 - Improper input validation
CVE-2023-32692
CWE-20 High
No
No
4.3.5 21.05.2023 SB2023052104
#VU132166 - Improper Authentication
CVE-2022-46170
CWE-287 High
No
No
4.2.11 22.12.2022 SB2022122233
#VU132167 - Insufficient Verification of Data Authenticity
CVE-2022-23556
CWE-345 Medium
No
No
4.2.11 22.12.2022 SB2022122233
#VU132165 - Improper Initialization
CVE-2022-39284
CWE-665 Medium
No
No
4.2.7 06.10.2022 SB2022100669
#VU66761 - Cross-Site Request Forgery (CSRF)
CWE-352 Low
No
No
4.2.3 25.08.2022 SB2022082538
#VU132162 - Cross-Site Request Forgery (CSRF)
CVE-2022-24712
CWE-352 Low
No
No
4.1.9 26.02.2022 SB2022022608
#VU132163 - Improper input validation
CVE-2022-24711
CWE-20 High
No
No
4.1.9 26.02.2022 SB2022022608
#VU60026 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2022-21715
CWE-79 Low
No
No
4.1.8 26.01.2022 SB2022012626
#VU132164 - Deserialization of Untrusted Data
CVE-2022-21647
CWE-502 Medium
No
No
4.1.6 04.01.2022 SB2022010433