CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-10793
https://notcve.org/view.php?id=CVE-2020-10793
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself. CodeIgniter hasta la versión 4.0.0 permite a los atacantes remotos obtener privilegios a través de un ID de correo electrónico modificado a la página "Seleccionar el rol del usuario". • https://codeigniter4.github.io/userguide/extending/authentication.html https://medium.com/%40vbharad/account-takeover-via-modifying-email-id-codeigniter-framework-ca30741ad297 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-3907
https://notcve.org/view.php?id=CVE-2015-3907
CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks. CodeIgniter Rest Server (también conocido como codeigniter-restserver) en la versión 2.7.1 permite ataques de tipo XXE. • https://kb.hitcon.org/post/127839729207/codeigniter-rest-server-module-xxe-cve-2015-3907 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-12071
https://notcve.org/view.php?id=CVE-2018-12071
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled. Existe un problema de fijación de sesión en CodeIgniter en versiones anteriores a la 3.1.9 debido a que session.use_strict_mode se gestionó de manera incorrecta en Session Library. • https://www.codeigniter.com/user_guide/changelog.html • CWE-384: Session Fixation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5725
https://notcve.org/view.php?id=CVE-2015-5725
SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable. Vulnerabilidad de inyección SQL en el método offset en la clase Active Record en CodeIgniter, en versiones anteriores a la 2.2.4, permite que atacantes remotos ejecuten comandos SQL arbitrarios mediante vectores relacionados con la variable offset. • https://forum.codeigniter.com/thread-62743.html https://github.com/bcit-ci/CodeIgniter/commit/0dde92def6b9f276f05ff77abb07ead318f9ec23 https://github.com/bcit-ci/CodeIgniter/issues/4020 https://www.codeigniter.com/userguide2/changelog.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2013-4891
https://notcve.org/view.php?id=CVE-2013-4891
The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an unclosed HTML tag. La función xss_clean en CodeIgniter, en versiones anteriores a la 2.1.4, podría permitir que atacantes remotos omitan un mecanismo de protección planeado y lleven a cabo ataques de Cross-Site Scripting (XSS) mediante unaetiqueta HTML no cerrada. • https://github.com/bcit-ci/CodeIgniter/issues/4020 https://nealpoole.com/blog/2013/07/codeigniter-21-xss-clean-filter-bypass https://www.codeigniter.com/userguide2/changelog.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •