36 results (0.002 seconds)

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-46240 – CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environment

https://notcve.org/view.php?id=CVE-2023-46240

31 Oct 2023 — CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`. • https://codeigniter4.github.io/userguide/general/errors.html#error-reporting • CWE-209: Generation of Error Message Containing Sensitive Information •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-32692 – Remote Code Execution Vulnerability in Validation Placeholders

https://notcve.org/view.php?id=CVE-2023-32692

30 May 2023 — CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally. This issue is patched in version 4.3.5. CodeIgniter es un framework web PHP full-stack. • https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2022-46170 – CodeIgniter is vulnerable to improper authentication via Session Handlers

https://notcve.org/view.php?id=CVE-2022-46170

22 Dec 2022 — CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler is set to `DatabaseHandler`, `MemcachedHandler`, or `RedisHandler`, then if an attacker gets one session cookie (e.g., one for user pages), they may be able to access pages that require another session cookie (e.g., for admin pages). This issue has been patched, please upgrade to version 4.2.11 or later. As a workaround, use only on... • https://github.com/codeigniter4/CodeIgniter4/commit/f9fb6574fbeb5a4aa63f7ea87296523e10db9328 • CWE-287: Improper Authentication •

CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2022-23556 – CodeIgniter is vulnerable to IP address spoofing when using proxy

https://notcve.org/view.php?id=CVE-2022-23556

22 Dec 2022 — CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`. CodeIgniter es un framework web PHP de full-stack. • https://github.com/codeigniter4/CodeIgniter4/commit/5ca8c99b2db09a2a08a013836628028ddc984659 • CWE-345: Insufficient Verification of Data Authenticity •

CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2022-40825

https://notcve.org/view.php?id=CVE-2022-40825

07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php where_in() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2022-40829

https://notcve.org/view.php?id=CVE-2022-40829

07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php or_like() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2022-40832

https://notcve.org/view.php?id=CVE-2022-40832

07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php having() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2022-40835

https://notcve.org/view.php?id=CVE-2022-40835

07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a valid vulnerability B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio del archivo system\database\DB_query_builder.php • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2022-40824

https://notcve.org/view.php?id=CVE-2022-40824

07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función system\database\DB_query_builder.php or_where() • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 10.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2022-40831

https://notcve.org/view.php?id=CVE-2022-40831

07 Oct 2022 — B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have disputed this as not a valid vulnerability. B.C. Institute of Technology CodeIgniter versiones anteriores a 3.1.13 incluyéndola, es vulnerable a una inyección SQL por medio de la función like() de system\database\DB_query_builder.php • https://github.com/726232111/CodeIgniter3.1.13-SQL-Inject/blob/main/README.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •