Vendor
CodeIgniter Path Traversal via UploadedFile::move()
2 TTPs 1 CVECodeIgniter Framework versions prior to 4.7.4 contain a path traversal vulnerability in the UploadedFile::move() method that allows attackers to write files to arbitrary filesystem locations when unsanitized client filenames are processed.
SQL Injection in CodeIgniter4 Query Builder deleteBatch Method
1 TTP 1 CVEA SQL injection vulnerability in CodeIgniter4 (CVE-2026-63221) allows unauthenticated attackers to execute arbitrary SQL via improperly handled where() clauses when using the deleteBatch() method.
CodeIgniter4 Unsafe File Upload Validation Bypass
2 TTPs 1 CVECodeIgniter4 versions before 4.7.4 contain an unsafe file upload validation bypass in 'is_image' and 'mime_in' rules, allowing attackers to upload arbitrary files that could result in remote code execution.
CI4MS Stored XSS Vulnerability in Pages Module
2 rules 3 TTPs 1 IOCA stored XSS vulnerability (CVE-2026-45270) exists in the Pages module of CI4MS due to improper sanitization of page content, allowing an attacker with `pages.create` permissions to inject malicious code and escalate privileges if an administrator views the page.