CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46240 – CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
https://notcve.org/view.php?id=CVE-2023-46240
31 Oct 2023 — CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`. • https://codeigniter4.github.io/userguide/general/errors.html#error-reporting • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32692 – Remote Code Execution Vulnerability in Validation Placeholders
https://notcve.org/view.php?id=CVE-2023-32692
30 May 2023 — CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5. CodeIgniter es un framework web PHP full-stack. • https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40825
https://notcve.org/view.php?id=CVE-2022-40825
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php where_in() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40829
https://notcve.org/view.php?id=CVE-2022-40829
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php or_like() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40832
https://notcve.org/view.php?id=CVE-2022-40832
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php having() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40835
https://notcve.org/view.php?id=CVE-2022-40835
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a valid vulnerability B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio del archivo system\database\DB_query_builder.php • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40824
https://notcve.org/view.php?id=CVE-2022-40824
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php or_where() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40831
https://notcve.org/view.php?id=CVE-2022-40831
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función like() de system\database\DB_query_builder.php • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40828
https://notcve.org/view.php?id=CVE-2022-40828
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php or_where_not_in() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1CVE-2022-40826
https://notcve.org/view.php?id=CVE-2022-40826
07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php or_having() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •