Codeigniter is a widely deployed PHP web application framework whose vulnerability footprint, though concentrated in a narrow product line, reaches a large proportion of web applications built on the framework and its security module Shield. Vulnerabilities affecting Codeigniter skew strongly toward critical-severity outcomes and frequently acquire public exploit code, reflecting the framework's role in handling user input and request processing across a broad installed base. The exposure recurs through web-tier weakness classes including SQL injection, cross-site scripting, cross-site request forgery, and improper input validation—all characteristic of framework-level flaws that can propagate to dependent applications. Defenders should treat framework-layer vulnerabilities in this vendor as broadly applicable to their web application portfolio and prioritize patch cycles accordingly; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Codeigniter over time
Signals from CVEs in this vendor scope (43 CVEs).
43 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-8684CRITICAL CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injecti | Sep 19, 2017 | 9.8 | 80 | NO | YES |
CVE-2014-8686CRITICAL CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is | Sep 19, 2017 | 9.8 | 70 | NO | YES |
CVE-2022-21647CRITICAL CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-lo | Jan 4, 2022 | 9.8 | 52 | NO | NO |
CVE-2025-54418CRITICAL CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image | Jul 28, 2025 | 9.8 | 35 | NO | NO |
CVE-2023-32692CRITICAL CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exists in the V | May 30, 2023 | 9.8 | 31 | NO | NO |
CVE-2022-40835CRITICAL B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed this as not a | Oct 7, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-40827CRITICAL B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties have disput | Oct 7, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-46170CRITICAL CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2) a session handler i | Dec 22, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-40834CRITICAL B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third parties have | Oct 7, 2022 | 9.8 | 30 | NO | NO |
CVE-2022-40833CRITICAL B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third parties have | Oct 7, 2022 | 9.8 | 30 | NO | NO |
Signals from CVEs in this vendor scope (43 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Codeigniter.
Media articles that mention a CVE ID that affects a product developed by Codeigniter — matched by CVE ID, not by vendor name.