Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
123 results · page 3 of 3
Sep 2, 2020Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php.CVE-2020-25091 · Websites & servers · Ecommerce-codeigniter-bootstrap Project · reported by MITREMedium 6.1
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/vendor/views/add_product.php.
- Product
- Ecommerce-codeigniter-bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php.CVE-2020-25090 · Websites & servers · Ecommerce-codeigniter-bootstrap Project · reported by MITREMedium 6.1
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/publish.php.
- Product
- Ecommerce-codeigniter-bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php.CVE-2020-25089 · Websites & servers · Ecommerce-codeigniter-bootstrap Project · reported by MITREMedium 6.1
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/ecommerce/discounts.php.
- Product
- Ecommerce-codeigniter-bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php.CVE-2020-25088 · Websites & servers · Ecommerce-codeigniter-bootstrap Project · reported by MITREMedium 6.1
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/blog/blogpublish.php.
- Product
- Ecommerce-codeigniter-bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php.CVE-2020-25087 · Websites & servers · Ecommerce-codeigniter-bootstrap Project · reported by MITREMedium 6.1
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/languages.php.
- Product
- Ecommerce-codeigniter-bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2020Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php.CVE-2020-25086 · Websites & servers · Ecommerce-codeigniter-bootstrap Project · reported by MITREMedium 6.1
Ecommerce-CodeIgniter-Bootstrap before 2020-08-03 allows XSS in application/modules/admin/views/advanced_settings/adminUsers.php.
- Product
- Ecommerce-codeigniter-bootstrap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2020Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF).CVE-2020-16610 · Other software · Hoosk · reported by MITREMedium 4.3
Hoosk Codeigniter CMS before 1.7.2 is affected by a Cross Site Request Forgery (CSRF). When an attacker induces authenticated admin user to a malicious web page, any accounts can be deleted without admin user's intention.
- Product
- Hoosk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2020CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page.CVE-2020-10793 · Other software · Codeigniter · reported by MITREHigh 8.8
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framework argues that the issue should not be attributed to CodeIgniter. Furthermore, the blog post reference shows an unknown website built with the CodeIgniter framework but that CodeIgniter is not responsible for introducing this issue because the framework has never provided a login screen, nor any kind of login or user management facilities beyond a Session library. Also, another reporter indicates the issue is with a custom module/plugin to CodeIgniter, not CodeIgniter itself.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeigniter4.github.iomedium.com
Jan 9, 2020EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.CVE-2012-1915 · Other software · Codeigniter · reported by MITREMedium 6.1
EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecurityfocus.com
Jul 3, 2019CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.CVE-2015-3907 · Other software · Codeigniter-restserver Project · reported by MITRECritical 9.8
CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.
- Product
- Codeigniter-restserver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.hitcon.orgkb.hitcon.org
Oct 19, 2018LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI.CVE-2018-18416 · Other software · Pokkho · reported by MITREMedium 4.8
LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the site_name parameter to the admin/settings/update URI.
- Product
- Lango
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jun 17, 2018A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.CVE-2018-12071 · Other software · Codeigniter · reported by MITRECritical 9.8
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comcodeigniter.com
Feb 21, 2018SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commandCVE-2015-5725 · Other software · Codeigniter · reported by MITRECritical 9.8
SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors involving the offset variable.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.codeigniter.comgithub.com
Feb 21, 2018The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSSCVE-2013-4891 · Other software · Codeigniter · reported by MITREMedium 6.1
The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an unclosed HTML tag.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnealpoole.com
Nov 16, 2017British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resultCVE-2017-1000247 · Other software · Codeigniter · reported by MITREHigh 7.5
British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header Injection flaws.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcodeigniter.comcodeigniter.com
Sep 19, 2017CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt CVE-2014-8686 · Other software · Codeigniter · reported by MITRECritical 9.8
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.combeyondbinary.io
Sep 19, 2017CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conducCVE-2014-8684 · Other software · Codeigniter · reported by MITRECritical 9.8
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 12, 2017system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insCVE-2016-10131 · Other software · Codeigniter · reported by MITRECritical 9.8
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgist.github.com
Sep 23, 2011CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mCVE-2011-3719 · Other software · Codeigniter · reported by MITREMedium 5
CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by system/scaffolding/views/view.php and certain other files.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comcode.google.com
Jul 11, 2007Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitrarCVE-2007-3707 · Other software · Codeigniter · reported by MITREMedium 5
Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitrary files via a .. (dot dot) in the c parameter.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukosvdb.org
Jul 11, 2007CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sCVE-2007-3709 · Other software · Codeigniter · reported by MITREMedium 5
CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in an unspecified parameter, as demonstrated by a Set-Cookie header.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukosvdb.org
Jul 11, 2007Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCVE-2007-3708 · Other software · Codeigniter · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2) malformed nested tag manipulations in an unspecified component, related to insufficient sanitization by the xss_clean function.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukosvdb.org
Jul 11, 2007The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demoCVE-2007-3706 · Other software · Codeigniter · reported by MITRELow 2.1
The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demonstrated by a _SERVER cookie.
- Product
- Codeigniter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.