Codeigniter

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

1. CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object inject…CVE-2014-8684Codeigniter · 72% likely

   CWE-310

2. CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP i…CVE-2014-8686Codeigniter · 37% likely

   CWE-310

3. system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail comman…CVE-2016-10131Codeigniter · 3.1% likely

   CWE-74

4. SQL injection vulnerability in the offset method in the Active Record class in CodeIgniter before 2.2.4 allows remote attackers to execute arbitrary SQL commands via vectors invol…CVE-2015-5725Codeigniter · 2.3% likely

   CWE-89

5. CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgniter framewor…CVE-2020-10793Codeigniter · 1.9% likely

   CWE-269

6. EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.CVE-2012-1915Codeigniter · 1.9% likely

   CWE-79

7. Directory traversal vulnerability in index.php in CodeIgniter 1.5.3 before 20070628, when enable_query_strings is true, allows remote attackers to read arbitrary files via a .. (d…CVE-2007-3707Codeigniter · 1.7% likely
8. A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.CVE-2018-12071Codeigniter · 1.5% likely

   CWE-384

9. The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an un…CVE-2013-4891Codeigniter · 1.4% likely

   CWE-79

10. CodeIgniter 1.7.2 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstr…CVE-2011-3719Codeigniter · 1.3% likely

    CWE-200

11. Cross-site scripting (XSS) vulnerability in CodeIgniter 1.5.3 before 20070626 allows remote attackers to inject arbitrary web script or HTML via (1) String.fromCharCode and (2) ma…CVE-2007-3708Codeigniter · 1.2% likely
12. CRLF injection vulnerability in the redirect function in url_helper.php in CodeIgniter 1.5.3 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in an unsp…CVE-2007-3709Codeigniter · 1.2% likely
13. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a…CVE-2022-40835Codeigniter · 1.1% likely

    CWE-89

14. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have…CVE-2022-40834Codeigniter · 1.1% likely

    CWE-89

15. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have…CVE-2022-40833Codeigniter · 1.1% likely

    CWE-89

16. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties have disp…CVE-2022-40832Codeigniter · 1.1% likely

    CWE-89

17. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties have disput…CVE-2022-40831Codeigniter · 1.1% likely

    CWE-89

18. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third parties hav…CVE-2022-40830Codeigniter · CVSS 9.8 · 1.1% likely

    CWE-89

19. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third parties have dis…CVE-2022-40829Codeigniter · CVSS 9.8 · 1.1% likely

    CWE-89

20. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple third parties…CVE-2022-40828Codeigniter · CVSS 9.8 · 1.1% likely

    CWE-89

21. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third parties have d…CVE-2022-40826Codeigniter · CVSS 9.8 · 1.1% likely

    CWE-89

22. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parties have di…CVE-2022-40825Codeigniter · 1.1% likely

    CWE-89

23. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parties have di…CVE-2022-40824Codeigniter · CVSS 9.8 · 1.1% likely

    CWE-89

24. B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have dispu…CVE-2022-40827Codeigniter · CVSS 9.8 · 1.0% likely

    CWE-89

25. British Columbia Institute of Technology CodeIgniter 3.1.3 is vulnerable to HTTP Header Injection in the set_status_header() common function under Apache resulting in HTTP Header…CVE-2017-1000247Codeigniter · 0.9% likely

    CWE-20

26. The _sanitize_globals function in CodeIgniter 1.5.3 before 20070628 allows remote attackers to unset arbitrary global variables with unspecified impact, as demonstrated by a _SERV…CVE-2007-3706Codeigniter · 0.6% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.