CodeIgniter4

Every one of the 17 is a mark on the map. Named now: 1 to 17, most at risk first.

1. Deserialization of Untrusted Data in Codeigniter4CVE-2022-21647codeigniter4 · CVSS 7.7 · 38% likely
2. CodeIgniter4's ImageMagick Handler has Command Injection VulnerabilityCVE-2025-54418codeigniter4 · CVSS 9.8 · 1.5% likely
3. Remote CLI Command Execution Vulnerability in CodeIgniter4CVE-2022-24711codeigniter4 · CVSS 9.4 · 1.2% likely
4. Remote Code Execution Vulnerability in Validation PlaceholdersCVE-2023-32692codeigniter4 · CVSS 9.8 · 1.1% likely
5. Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued in Codeigniter4CVE-2022-39284codeigniter4 · CVSS 2.6 · 1.1% likely
6. Cross-site Scripting Vulnerability in CodeIgniter4CVE-2022-21715codeigniter4 · CVSS 5.4 · 1.0% likely
7. CodeIgniter is vulnerable to improper authentication via Session HandlersCVE-2022-46170codeigniter4 · CVSS 8.6 · 0.9% likely
8. CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rulesCVE-2026-63223codeigniter4 · CVSS 9.8 · 0.8% likely
9. CodeIgniter4 vulnerable to information disclosure when detailed error report is displayed in production environmentCVE-2023-46240codeigniter4 · CVSS 7.5 · 0.8% likely
10. CodeIgniter: Uploaded file extension validation bypass in `ext_in` ruleCVE-2026-48062codeigniter4 · CVSS 9.8 · 0.8% likely
11. CodeIgniter4 Language class DoS VulnerabilityCVE-2024-29904codeigniter4 · CVSS 7.5 · 0.8% likely
12. CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenamesCVE-2026-63222codeigniter4 · CVSS 7.5 · 0.6% likely
13. CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditionsCVE-2026-63221codeigniter4 · CVSS 9.4 · 0.6% likely
14. Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4CVE-2022-24712codeigniter4 · CVSS 6.3 · 0.6% likely
15. CodeIgniter validation of header name and valueCVE-2025-24013codeigniter4 · CVSS 5.3 · 0.5% likely
16. CodeIgniter is vulnerable to IP address spoofing when using proxyCVE-2022-23556codeigniter4 · CVSS 7 · 0.4% likely
17. CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()CVE-2026-63220codeigniter4 · CVSS 4.8 · 0.2% likely

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.