CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2024-6526 – CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting
https://notcve.org/view.php?id=CVE-2024-6526
A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/1b3da45308bb6c3f55247d0e99620b600bd85277 https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/263 https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/263#issuecomment-2199387443 https://vuldb.com/?ctiid.270369 https://vuldb.com/?id.270369 https://vuldb.com/?submit.368472 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46240 – CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
https://notcve.org/view.php?id=CVE-2023-46240
CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`. • https://codeigniter4.github.io/userguide/general/errors.html#error-reporting https://github.com/codeigniter4/CodeIgniter4/commit/423569fc31e29f51635a2e59c89770333f0e7563 https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hwxf-qxj7-7rfj • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32692 – Remote Code Execution Vulnerability in Validation Placeholders
https://notcve.org/view.php?id=CVE-2023-32692
CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5. CodeIgniter es un framework web PHP full-stack. • https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2023-23010
https://notcve.org/view.php?id=CVE-2023-23010
Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php. Vulnerabilidad de cross site scripting (XSS) en Ecommerce-CodeIgniter-Bootstrap a través del commit d5904379ca55014c5df34c67deda982c73dc7fe5 (el 27 de diciembre de 2022), permite a atacantes ejecutar código arbitrario a través de los idiomas y los parámetros trans_load en el archivo add_product.php. • https://gist.github.com/enferas/8a836008e9f635a2f80d09c9a8b5a533 https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d5904379ca55014c5df34c67deda982c73dc7fe5 https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/242 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46170 – CodeIgniter is vulnerable to improper authentication via Session Handlers
https://notcve.org/view.php?id=CVE-2022-46170
CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only one session cookie. CodeIgniter es un framework web PHP full-stack. • https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328 https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-6cq5-8cj7-g558 • CWE-287: Improper Authentication •