{"url":"http://public2.vulnerablecode.io/api/packages/201262?format=json","purl":"pkg:composer/codeigniter/framework@3.0rc2","type":"composer","namespace":"codeigniter","name":"framework","version":"3.0rc2","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":null,"latest_non_vulnerable_version":null,"affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37886?format=json","vulnerability_id":"VCID-3kby-g5ka-cff3","summary":"SQL Injection\nCritical SQL injection bug in the ODBC database driver.","references":[{"reference_url":"https://forum.codeigniter.com/thread-65803.html","reference_id":"","reference_type":"","scores":[],"url":"https://forum.codeigniter.com/thread-65803.html"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52330?format=json","purl":"pkg:composer/codeigniter/framework@3.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"},{"vulnerability":"VCID-s814-tdxe-1baf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.1.0"}],"aliases":["GMS-2016-130"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-3kby-g5ka-cff3"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37934?format=json","vulnerability_id":"VCID-8wbz-we3g-x3ep","summary":"Cross-site Scripting\nXSS attack vector in Security Library method `xss_clean()`.","references":[{"reference_url":"https://www.codeigniter.com/user_guide/changelog.html#version-3-0-3","reference_id":"","reference_type":"","scores":[],"url":"https://www.codeigniter.com/user_guide/changelog.html#version-3-0-3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52389?format=json","purl":"pkg:composer/codeigniter/framework@3.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-a6px-3qen-euct"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-ebrh-16ww-3bhd"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"},{"vulnerability":"VCID-s814-tdxe-1baf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.0.3"}],"aliases":["GMS-2015-65"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-8wbz-we3g-x3ep"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/44188?format=json","vulnerability_id":"VCID-9gnz-bcac-5ygs","summary":"CodeIgniter and Kohana vulnerable to PHP Object Injection\nCodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.","references":[{"reference_url":"http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html"},{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2014-8684","reference_id":"","reference_type":"","scores":[{"value":"0.44845","scoring_system":"epss","scoring_elements":"0.97647","published_at":"2026-06-04T12:55:00Z"},{"value":"0.44845","scoring_system":"epss","scoring_elements":"0.97652","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2014-8684"},{"reference_url":"http://seclists.org/fulldisclosure/2014/May/54","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"http://seclists.org/fulldisclosure/2014/May/54"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159"},{"reference_url":"https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32"},{"reference_url":"https://github.com/kohana/core/pull/492","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/kohana/core/pull/492"},{"reference_url":"https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8684","reference_id":"CVE-2014-8684","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8684"},{"reference_url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/36264.rb","reference_id":"CVE-2014-8686;CVE-2014-8684;OSVDB-118925;CVE-2014-8687","reference_type":"exploit","scores":[],"url":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/php/remote/36264.rb"},{"reference_url":"https://github.com/advisories/GHSA-w9ph-q4h9-rwq6","reference_id":"GHSA-w9ph-q4h9-rwq6","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-w9ph-q4h9-rwq6"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/63563?format=json","purl":"pkg:composer/codeigniter/framework@3.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3kby-g5ka-cff3"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-8wbz-we3g-x3ep"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-a6px-3qen-euct"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-ebrh-16ww-3bhd"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-gubk-qp7e-h7f4"},{"vulnerability":"VCID-jn5c-h7cd-skfq"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"},{"vulnerability":"VCID-s814-tdxe-1baf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.0.0"}],"aliases":["CVE-2014-8684","GHSA-w9ph-q4h9-rwq6"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-9gnz-bcac-5ygs"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/38182?format=json","vulnerability_id":"VCID-a6px-3qen-euct","summary":"Critical SQL injection bug in the ODBC database driver\nThere's a critical SQL injection bug in the ODBC database driver.","references":[{"reference_url":"http://forum.codeigniter.com/thread-65803.html","reference_id":"","reference_type":"","scores":[],"url":"http://forum.codeigniter.com/thread-65803.html"},{"reference_url":"http://www.codeigniter.com/user_guide/changelog.html#version-3-1-0","reference_id":"","reference_type":"","scores":[],"url":"http://www.codeigniter.com/user_guide/changelog.html#version-3-1-0"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52330?format=json","purl":"pkg:composer/codeigniter/framework@3.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"},{"vulnerability":"VCID-s814-tdxe-1baf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.1.0"}],"aliases":["GMS-2016-55"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-a6px-3qen-euct"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54825?format=json","vulnerability_id":"VCID-ebrh-16ww-3bhd","summary":"codeigniter/framework SQL injection in ODBC database driver\nCodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This update includes crucial fixes to mitigate a SQL injection vulnerability, preventing potential exploitation by attackers. It is noteworthy that these fixes render the query builder and escape() functions incompatible with the ODBC driver. However, the update introduces actual query binding as a more secure alternative.","references":[{"reference_url":"https://forum.codeigniter.com/thread-65803.html","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://forum.codeigniter.com/thread-65803.html"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter/framework/2016-07-26-1.yaml","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter/framework/2016-07-26-1.yaml"},{"reference_url":"https://github.com/simplysites/CodeIgniter","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/simplysites/CodeIgniter"},{"reference_url":"https://github.com/simplysites/CodeIgniter/commit/3d10ffa77854044570a1809a884776fd4bbd8b70","reference_id":"","reference_type":"","scores":[{"value":"10.0","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/simplysites/CodeIgniter/commit/3d10ffa77854044570a1809a884776fd4bbd8b70"},{"reference_url":"https://github.com/advisories/GHSA-27qr-636m-wxg2","reference_id":"GHSA-27qr-636m-wxg2","reference_type":"","scores":[{"value":"CRITICAL","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-27qr-636m-wxg2"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52330?format=json","purl":"pkg:composer/codeigniter/framework@3.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"},{"vulnerability":"VCID-s814-tdxe-1baf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.1.0"}],"aliases":["GHSA-27qr-636m-wxg2"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-ebrh-16ww-3bhd"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/109916?format=json","vulnerability_id":"VCID-fpcv-9quu-8fe2","summary":"CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection\n### Impact\nThis vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield.\n\nFor this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`).\n\nThis vulnerability exists whether `Config\\Security::$csrfProtection` is `'cookie'` or `'session'`.\nIt is also exploitable whether `Config\\Security::$regenerate` is `true` or `false`.\n\n### Patches\nUpgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**.\n\n### Workarounds\nDo all of the following:\n- set `Config\\Security::$csrfProtection` to `'session'`\n- remove old session data right after login (immediately after ID and password match)\n- regenerate CSRF token right after login (immediately after ID and password match)\n\n### References\n- [CodeIgniter4 CSRF Protection](https://codeigniter4.github.io/userguide/libraries/security.html)\n- [SameSite Attacks](https://canitakeyoursubdomain.name/)\n- [SameSite Cookies](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite)\n- [The great SameSite confusion](https://jub0bs.com/posts/2021-01-29-great-samesite-confusion/)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)\n* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2022-35943","reference_id":"","reference_type":"","scores":[{"value":"0.00153","scoring_system":"epss","scoring_elements":"0.35637","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00153","scoring_system":"epss","scoring_elements":"0.3574","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2022-35943"},{"reference_url":"https://codeigniter4.github.io/userguide/libraries/security.htm","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:45:07Z/"}],"url":"https://codeigniter4.github.io/userguide/libraries/security.htm"},{"reference_url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:45:07Z/"}],"url":"https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite"},{"reference_url":"https://github.com/codeigniter4/shield","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/codeigniter4/shield"},{"reference_url":"https://github.com/codeigniter4/shield/commit/342a368536678621998c3c41d276480cd14ec6c6","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/codeigniter4/shield/commit/342a368536678621998c3c41d276480cd14ec6c6"},{"reference_url":"https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:45:07Z/"}],"url":"https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq"},{"reference_url":"https://jub0bs.com/posts/2021-01-29-great-samesite-confusion","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-22T15:45:07Z/"}],"url":"https://jub0bs.com/posts/2021-01-29-great-samesite-confusion"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35943","reference_id":"","reference_type":"","scores":[{"value":"5.9","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35943"},{"reference_url":"https://github.com/advisories/GHSA-5hm8-vh6r-2cjq","reference_id":"GHSA-5hm8-vh6r-2cjq","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-5hm8-vh6r-2cjq"}],"fixed_packages":[],"aliases":["CVE-2022-35943","GHSA-5hm8-vh6r-2cjq"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-fpcv-9quu-8fe2"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/37935?format=json","vulnerability_id":"VCID-gubk-qp7e-h7f4","summary":"XSS vulnerability\nThere's an XSS attack vector in Security Library method `xss_clean()`.","references":[{"reference_url":"https://github.com/bcit-ci/CodeIgniter/commit/249580e711d42fe966e52d7bcc0f349ba99a94a3","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/bcit-ci/CodeIgniter/commit/249580e711d42fe966e52d7bcc0f349ba99a94a3"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/commit/4fbf2d1a8e2b6d33e92f3f353b05388fd3229bd7","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/bcit-ci/CodeIgniter/commit/4fbf2d1a8e2b6d33e92f3f353b05388fd3229bd7"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/commit/71b1b3f5b2dcc0f4b652e9494e9853b82541ac8c","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/bcit-ci/CodeIgniter/commit/71b1b3f5b2dcc0f4b652e9494e9853b82541ac8c"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/commit/f0f47da9ae4227968ccc9ee6511bcab526498b4c","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/bcit-ci/CodeIgniter/commit/f0f47da9ae4227968ccc9ee6511bcab526498b4c"},{"reference_url":"http://www.codeigniter.com/user_guide/changelog.html#version-3-0-3","reference_id":"","reference_type":"","scores":[],"url":"http://www.codeigniter.com/user_guide/changelog.html#version-3-0-3"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52389?format=json","purl":"pkg:composer/codeigniter/framework@3.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-a6px-3qen-euct"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-ebrh-16ww-3bhd"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"},{"vulnerability":"VCID-s814-tdxe-1baf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.0.3"}],"aliases":["GMS-2015-40"],"risk_score":null,"exploitability":"0.5","weighted_severity":"0.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-gubk-qp7e-h7f4"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/54916?format=json","vulnerability_id":"VCID-jn5c-h7cd-skfq","summary":"Inadequate XSS Prevention in CodeIgniter/Framework Security Library\nThe xss_clean() method in the Security Library of CodeIgniter/Framework, specifically in versions before 3.0.3, exhibited a vulnerability that allowed certain Cross-Site Scripting (XSS) vectors to bypass its intended protection mechanisms.\n\nThe xss_clean() method is designed to sanitize input data by removing potentially malicious content, thus preventing XSS attacks. However, in versions prior to 3.0.3, it was discovered that the method did not adequately mitigate specific XSS vectors, leaving a potential security gap.","references":[{"reference_url":"https://github.com/bcit-ci/CodeIgniter","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bcit-ci/CodeIgniter"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/commit/71b1b3f5b2dcc0f4b652e9494e9853b82541ac8c","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bcit-ci/CodeIgniter/commit/71b1b3f5b2dcc0f4b652e9494e9853b82541ac8c"},{"reference_url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter/framework/2015-10-31-1.yaml","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/codeigniter/framework/2015-10-31-1.yaml"},{"reference_url":"https://www.codeigniter.com/user_guide/changelog.html#version-3-0-3","reference_id":"","reference_type":"","scores":[{"value":"4.7","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.codeigniter.com/user_guide/changelog.html#version-3-0-3"},{"reference_url":"https://github.com/advisories/GHSA-q9j3-4ghj-6h57","reference_id":"GHSA-q9j3-4ghj-6h57","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q9j3-4ghj-6h57"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/52389?format=json","purl":"pkg:composer/codeigniter/framework@3.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-a6px-3qen-euct"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-ebrh-16ww-3bhd"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"},{"vulnerability":"VCID-s814-tdxe-1baf"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.0.3"}],"aliases":["GHSA-q9j3-4ghj-6h57"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-jn5c-h7cd-skfq"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45245?format=json","vulnerability_id":"VCID-qdfk-n9gt-6yfp","summary":"Duplicate\nThis advisory duplicates another.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32692","reference_id":"","reference_type":"","scores":[{"value":"0.0181","scoring_system":"epss","scoring_elements":"0.83197","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-32692"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/codeigniter4/CodeIgniter4"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-01-10T20:38:34Z/"}],"url":"https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md#v435-2023-05-21","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/codeigniter4/CodeIgniter4/blob/develop/CHANGELOG.md#v435-2023-05-21"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4/commit/6af677177fa1d9ad62f7a793bc96cba3068632ba","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/codeigniter4/CodeIgniter4/commit/6af677177fa1d9ad62f7a793bc96cba3068632ba"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32692","reference_id":"CVE-2023-32692","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32692"},{"reference_url":"https://github.com/advisories/GHSA-m6m8-6gq8-c9fj","reference_id":"GHSA-m6m8-6gq8-c9fj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-m6m8-6gq8-c9fj"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj","reference_id":"GHSA-m6m8-6gq8-c9fj","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2025-01-10T20:38:34Z/"}],"url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-m6m8-6gq8-c9fj"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65273?format=json","purl":"pkg:composer/codeigniter/framework@4.3.5","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@4.3.5"}],"aliases":["CVE-2023-32692","GHSA-m6m8-6gq8-c9fj","GMS-2023-1562"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-qdfk-n9gt-6yfp"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/46320?format=json","vulnerability_id":"VCID-s6nh-cvkt-vygr","summary":"Generation of Error Message Containing Sensitive Information\nCodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the production environment. As a result, confidential information may be leaked. Version 4.4.3 contains a patch. As a workaround, replace `ini_set('display_errors', '0')` with `ini_set('display_errors', 'Off')` in `app/Config/Boot/production.php`.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-46240","reference_id":"","reference_type":"","scores":[{"value":"0.00426","scoring_system":"epss","scoring_elements":"0.62653","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-46240"},{"reference_url":"https://codeigniter4.github.io/userguide/general/errors.html#error-reporting","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-05T17:35:16Z/"}],"url":"https://codeigniter4.github.io/userguide/general/errors.html#error-reporting"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/codeigniter4/CodeIgniter4"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4/commit/423569fc31e29f51635a2e59c89770333f0e7563","reference_id":"","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-05T17:35:16Z/"}],"url":"https://github.com/codeigniter4/CodeIgniter4/commit/423569fc31e29f51635a2e59c89770333f0e7563"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46240","reference_id":"CVE-2023-46240","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46240"},{"reference_url":"https://github.com/advisories/GHSA-hwxf-qxj7-7rfj","reference_id":"GHSA-hwxf-qxj7-7rfj","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-hwxf-qxj7-7rfj"},{"reference_url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hwxf-qxj7-7rfj","reference_id":"GHSA-hwxf-qxj7-7rfj","reference_type":"","scores":[{"value":"7.5","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-09-05T17:35:16Z/"}],"url":"https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-hwxf-qxj7-7rfj"}],"fixed_packages":[],"aliases":["CVE-2023-46240","GHSA-hwxf-qxj7-7rfj"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-s6nh-cvkt-vygr"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/39981?format=json","vulnerability_id":"VCID-s814-tdxe-1baf","summary":"A Session Fixation issue exists in CodeIgniter because `session.use_strict_mode` in the Session Library was mishandled.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2018-12071","reference_id":"","reference_type":"","scores":[{"value":"0.00242","scoring_system":"epss","scoring_elements":"0.4767","published_at":"2026-06-04T12:55:00Z"},{"value":"0.00242","scoring_system":"epss","scoring_elements":"0.47734","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2018-12071"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bcit-ci/CodeIgniter"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/commit/800a20d6c4662d99ae0988b2f8f2238bb8bb29db","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bcit-ci/CodeIgniter/commit/800a20d6c4662d99ae0988b2f8f2238bb8bb29db"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/commit/a9da3dd2f16a8f97d7bc4ff5572b28e4bb84c813#diff-32788a4d3748e8818044886ab43241179c7f5f5b82e979e73146669ca6e2da1cR306","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bcit-ci/CodeIgniter/commit/a9da3dd2f16a8f97d7bc4ff5572b28e4bb84c813#diff-32788a4d3748e8818044886ab43241179c7f5f5b82e979e73146669ca6e2da1cR306"},{"reference_url":"https://github.com/bcit-ci/CodeIgniter/issues/5958","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/bcit-ci/CodeIgniter/issues/5958"},{"reference_url":"https://web.archive.org/web/20181115214804/https://www.codeigniter.com/user_guide/changelog.html#version-3-1-9","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://web.archive.org/web/20181115214804/https://www.codeigniter.com/user_guide/changelog.html#version-3-1-9"},{"reference_url":"https://www.codeigniter.com/user_guide/changelog.html","reference_id":"","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://www.codeigniter.com/user_guide/changelog.html"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12071","reference_id":"CVE-2018-12071","reference_type":"","scores":[{"value":"9.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"value":"CRITICAL","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12071"},{"reference_url":"https://github.com/advisories/GHSA-g434-3q2j-hj4r","reference_id":"GHSA-g434-3q2j-hj4r","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-g434-3q2j-hj4r"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/63049?format=json","purl":"pkg:composer/codeigniter/framework@3.1.10","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-2hsz-vuhe-dbak"},{"vulnerability":"VCID-2qzt-eskd-7qf4"},{"vulnerability":"VCID-3mhu-ddhm-5ke7"},{"vulnerability":"VCID-52pj-ryan-2yfj"},{"vulnerability":"VCID-74bw-u8nc-3qbz"},{"vulnerability":"VCID-7wzt-96yg-jfah"},{"vulnerability":"VCID-9fmk-e4fz-2ybu"},{"vulnerability":"VCID-e2md-avz8-bya9"},{"vulnerability":"VCID-e4vu-fhp3-j3em"},{"vulnerability":"VCID-en5a-535z-ayca"},{"vulnerability":"VCID-fpcv-9quu-8fe2"},{"vulnerability":"VCID-gnfx-qs26-ukdx"},{"vulnerability":"VCID-p756-2jkm-9fc5"},{"vulnerability":"VCID-qdfk-n9gt-6yfp"},{"vulnerability":"VCID-s6nh-cvkt-vygr"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.1.10"}],"aliases":["CVE-2018-12071","GHSA-g434-3q2j-hj4r"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-s814-tdxe-1baf"}],"fixing_vulnerabilities":[],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:composer/codeigniter/framework@3.0rc2"}