Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/codeigniter/framework@3.0.3
purl pkg:composer/codeigniter/framework@3.0.3
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk score 4.5
Vulnerabilities affecting this package (19)
Advisory Summary Fixed in package version
GHSA-27qr-636m-wxg2

codeigniter/framework SQL injection in ODBC database driver CodeIgniter 3.1.0 addressed a critical security issue within the ODBC database driver. This …
3.1.0
Vulnerable
CVE-2022-40829

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40825

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40830

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40828

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40831

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40834

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
GMS-2016-55

Critical SQL injection bug in the ODBC database driver There's a critical SQL injection bug in the ODBC database driver.
3.1.0
Vulnerable
CVE-2022-40827

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40824

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40826

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40835

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2022-40833

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
CVE-2023-32692
Aliases:
GHSA-m6m8-6gq8-c9fj
Improper Control of Generation of Code ('Code Injection') CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to … There are no reported fixed by versions.
CVE-2022-35943
Aliases:
GHSA-5hm8-vh6r-2cjq
Cross-Site Request Forgery (CSRF) Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) … There are no reported fixed by versions.
GMS-2016-130

SQL Injection Critical SQL injection bug in the ODBC database driver.
3.1.0
Vulnerable
CVE-2022-40832

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable … There are no reported fixed by versions.
GHSA-g434-3q2j-hj4r
Aliases:
CVE-2018-12071
CodeIgniter Session Fixation Vulnerability A Session Fixation issue exists in CodeIgniter before 3.1.10 because `session.use_strict_mode` in the Session Library was …
3.1.10
Vulnerable
3.1.10
Vulnerable
CVE-2023-46240
Aliases:
GHSA-hwxf-qxj7-7rfj
Generation of Error Message Containing Sensitive Information CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if … There are no reported fixed by versions.
Vulnerabilities fixed by this package (3)

Advisory Summary Aliases
GHSA-q9j3-4ghj-6h57
Inadequate XSS Prevention in CodeIgniter/Framework Security Library The xss_clean() method in the Security Library of CodeIgniter/Framework, specifically in versions before …
GMS-2015-40
XSS vulnerability There's an XSS attack vector in Security Library method `xss_clean()`.
GMS-2015-65
Cross-site Scripting XSS attack vector in Security Library method `xss_clean()`.