CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41344
https://notcve.org/view.php?id=CVE-2024-41344
15 Oct 2024 — A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges. • https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/issues/264 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2024-6526 – CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting
https://notcve.org/view.php?id=CVE-2024-6526
05 Jul 2024 — A vulnerability classified as problematic has been found in CodeIgniter Ecommerce-CodeIgniter-Bootstrap up to 1998845073cf433bc6c250b0354461fbd84d0e03. This affects an unknown part. The manipulation of the argument search_title/catName/sub/name/categorie leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/1b3da45308bb6c3f55247d0e99620b600bd85277 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31820
https://notcve.org/view.php?id=CVE-2024-31820
29 Apr 2024 — An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the getLangFolderForEdit method of the Languages.php component. Un problema en el commit Ecommerce-CodeIgniter-Bootstrap v. d22b54e8915f167a135046ceb857caaf8479c4da permite a un atacante remoto ejecutar código arbitrario a través del método getLangFolderForEdit del componente Languages.php. • https://gist.github.com/LioTree/890b0eea95fce6225d820afe4e3510e9 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31822
https://notcve.org/view.php?id=CVE-2024-31822
29 Apr 2024 — An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the saveLanguageFiles method of the Languages.php component. Un problema en el commit Ecommerce-CodeIgniter-Bootstrap v. d22b54e8915f167a135046ceb857caaf8479c4da permite a un atacante remoto ejecutar código arbitrario a través del método saveLanguageFiles del componente Languages.php. • https://gist.github.com/LioTree/f83e25b2c5e144c0b3ad8919e6483c7a • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-48707 – Cleartext Storage of Sensitive Information in codeigniter4/shield
https://notcve.org/view.php?id=CVE-2023-48707
24 Nov 2023 — CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication and in affected versions was stored in the database in cleartext form. If a malicious person somehow had access to the data in the database, they could use the key and secretKey for HMAC SHA256 authentication to send requests impersonating that corresponding user. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. • https://github.com/codeigniter4/shield/commit/f77c6ae20275ac1245330a2b9a523bf7e6f6202f • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-48708 – Insertion of Sensitive Information into Log in codeigniter4/shield
https://notcve.org/view.php?id=CVE-2023-48708
24 Nov 2023 — CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then be used to send a request with that user's authority. This issue has been addressed in version 1.0.0-beta.8. Users are advised to upgrade. • https://codeigniter4.github.io/shield/getting_started/authenticators • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46240 – CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment
https://notcve.org/view.php?id=CVE-2023-46240
31 Oct 2023 — CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`. • https://codeigniter4.github.io/userguide/general/errors.html#error-reporting • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32692 – Remote Code Execution Vulnerability in Validation Placeholders
https://notcve.org/view.php?id=CVE-2023-32692
30 May 2023 — CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5. CodeIgniter es un framework web PHP full-stack. • https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-27580 – CodeIgniter Shield Password Shucking Vulnerability
https://notcve.org/view.php?id=CVE-2023-27580
13 Mar 2023 — CodeIgniter Shield provides authentication and authorization for the CodeIgniter 4 PHP framework. An improper implementation was found in the password storage process. All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible. If an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack th... • https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html • CWE-916: Use of Password Hash With Insufficient Computational Effort •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 2CVE-2023-23010
https://notcve.org/view.php?id=CVE-2023-23010
20 Jan 2023 — Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php. Vulnerabilidad de cross site scripting (XSS) en Ecommerce-CodeIgniter-Bootstrap a través del commit d5904379ca55014c5df34c67deda982c73dc7fe5 (el 27 de diciembre de 2022), permite a atacantes ejecutar código arbitrario a través de los idiomas y los pará... • https://gist.github.com/enferas/8a836008e9f635a2f80d09c9a8b5a533 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •