CodeIgniter records

43 published records for vendor CodeIgniter. 0 of them have been exploited in the wild (listed in CISA KEV) and 2 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 2 · 4.7%
Pre-auth RCE: 5
With a fix record: 46.5%
Median publish → KEV: No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

codeigniter

40 records

CVE records
Action	CVE	Vulnerability	Severity	EPSS · Published
61This week	CVE-2014-8684Weaponized	CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies andcodeigniter · codeigniter · CWE-310 Pre-auth	Critical9.8	72.1%Sep 19, 2017
60This week	CVE-2014-8686Weaponized	CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption schcodeigniter · codeigniter · CWE-310 Pre-auth	Critical9.8	37.2%Sep 19, 2017
50Plan	CVE-2022-21647No exploit	Deserialization of Untrusted Data in Codeigniter4codeigniter · codeigniter · CWE-502 Pre-auth SQL injection Deserialization	Critical9.8	37.6%Jan 4, 2022
40Plan	CVE-2016-10131No exploit	system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the emaicodeigniter · codeigniter · CWE-74 pre-auth RCE	Critical9.8	3.1%Jan 12, 2017
40Plan	CVE-2015-5725No exploit	SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute acodeigniter · codeigniter · CWE-89 pre-auth RCE SQL injection	Critical9.8	2.3%Feb 21, 2018
39Monitor	CVE-2018-12071No exploit	A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.codeigniter · codeigniter · CWE-384 Pre-auth	Critical9.8	1.5%Jun 17, 2018
39Monitor	CVE-2025-54418No exploit	CodeIgniter4's ImageMagick Handler has Command Injection Vulnerabilitycodeigniter · codeigniter · CWE-78 pre-auth RCE Command injection	Critical9.8	1.5%Jul 28, 2025
39Monitor	CVE-2022-24711No exploit	Remote CLI Command Execution Vulnerability in CodeIgniter4codeigniter · codeigniter · CWE-20 pre-auth RCE	Critical9.8	1.1%Feb 28, 2022
39Monitor	CVE-2023-32692Proof of concept	Remote Code Execution Vulnerability in Validation Placeholderscodeigniter · codeigniter · CWE-94 pre-auth RCE	Critical9.8	1.1%May 30, 2023
39Monitor	CVE-2022-40831No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40835No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40834No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40833No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40824No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40825No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40826No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40828No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40829No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40830No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40832No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-40827No exploit	B.C.codeigniter · codeigniter · CWE-89 Pre-auth SQL injection	Critical9.8	1.0%Oct 7, 2022
39Monitor	CVE-2022-46170No exploit	CodeIgniter is vulnerable to improper authentication via Session Handlerscodeigniter · codeigniter · CWE-287 Pre-auth Auth bypass	Critical9.8	0.9%Dec 22, 2022
36Monitor	CVE-2020-10793No exploit	CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page.codeigniter · codeigniter · CWE-269	High8.8	1.8%Mar 23, 2020
35Monitor	CVE-2022-35943No exploit	SameSite may allow cross-site request forgery (CSRF) protection to be bypassedcodeigniter · codeigniter · CWE-352 Pre-auth XSS CSRF	High8.8	0.6%Aug 12, 2022
35Monitor	CVE-2022-24712No exploit	Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4codeigniter · codeigniter · CWE-352 Pre-auth CSRF	High8.8	0.5%Feb 28, 2022

CVE-2014-8684
61This week
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and
CriticalCVSS 9.8WeaponizedEPSS 72%
- Pre-auth
codeigniter · codeigniterSep 19, 2017
CVE-2014-8686
60This week
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption sch
CriticalCVSS 9.8WeaponizedEPSS 37%
- Pre-auth
codeigniter · codeigniterSep 19, 2017
CVE-2022-21647
50Plan
Deserialization of Untrusted Data in Codeigniter4
CriticalCVSS 9.8No exploitEPSS 37%
- Pre-auth
- SQL injection
- Deserialization
codeigniter · codeigniterJan 4, 2022
CVE-2016-10131
40Plan
system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the emai
CriticalCVSS 9.8No exploitEPSS 3%
- pre-auth RCE
codeigniter · codeigniterJan 12, 2017
CVE-2015-5725
40Plan
SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute a
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- SQL injection
codeigniter · codeigniterFeb 21, 2018
CVE-2018-12071
39Monitor
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
codeigniter · codeigniterJun 17, 2018
CVE-2025-54418
39Monitor
CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
codeigniter · codeigniterJul 28, 2025
CVE-2022-24711
39Monitor
Remote CLI Command Execution Vulnerability in CodeIgniter4
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
codeigniter · codeigniterFeb 28, 2022
CVE-2023-32692
39Monitor
Remote Code Execution Vulnerability in Validation Placeholders
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
codeigniter · codeigniterMay 30, 2023
CVE-2022-40831
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40835
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40834
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40833
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40824
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40825
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40826
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40828
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40829
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40830
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40832
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-40827
39Monitor
B.C.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- SQL injection
codeigniter · codeigniterOct 7, 2022
CVE-2022-46170
39Monitor
CodeIgniter is vulnerable to improper authentication via Session Handlers
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
codeigniter · codeigniterDec 22, 2022
CVE-2020-10793
36Monitor
CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page.
HighCVSS 8.8No exploitEPSS 1%
codeigniter · codeigniterMar 23, 2020
CVE-2022-35943
35Monitor
SameSite may allow cross-site request forgery (CSRF) protection to be bypassed
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
- CSRF
codeigniter · codeigniterAug 12, 2022
CVE-2022-24712
35Monitor
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
codeigniter · codeigniterFeb 28, 2022