Packagist codeigniter4/framework

Name: Packagist codeigniter4/framework
Brand: Packagist

productUS

pkg:composer/codeigniter4/framework

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

4critical6high2medium0low

updated 2026-10-28

vulnerabilities (20)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-32692US	critical9.8	1.13% (66th)	Exploit	4.3.5	2023-05-30	< 4.3.5
CVE-2026-63223US	—	0.80% (56th)	Exploit	4.7.4	2026-07-31	< 4.7.4
CVE-2022-21647US	critical9.8	37.7% (99th)	—	4.1.6	2022-01-04	< 4.1.6
CVE-2020-10793US	high8.8	1.90% (80th)	—	no fix	2020-03-23	≤ 4.0.0
CVE-2025-54418US	—	1.53% (75th)	—	4.6.2	2025-07-28	< 4.6.2
CVE-2022-24711US	critical9.8	1.17% (67th)	—	4.1.9	2022-02-28	< 4.1.9
CVE-2022-39284US	medium4.3	1.12% (66th)	—	4.2.7	2022-10-06	< 4.2.7
CVE-2022-21715US	medium6.1	1.00% (63rd)	—	4.1.8	2022-01-24	< 4.1.8
CVE-2017-1000247US	high7.5	0.93% (60th)	—	3.1.4	2017-11-17	3.1.3 → 3.1.4
CVE-2022-46170US	critical9.8	0.91% (60th)	—	4.2.11	2022-12-22	< 4.2.11
CVE-2026-48062US	—	0.78% (56th)	—	4.7.3	2026-07-17	< 4.7.3
CVE-2024-29904US	high7.5	0.77% (56th)	—	4.4.7	2024-03-29	< 4.4.7
CVE-2026-63222US	—	0.64% (50th)	—	4.7.4	2026-07-31	< 4.7.4
CVE-2023-46240US	high7.5	0.62% (50th)	—	4.4.3	2023-10-31	< 4.4.3
CVE-2026-63221US	—	0.61% (49th)	—	4.7.4	2026-07-31	4.3.0 → 4.7.4
CVE-2022-24712US	high8.8	0.56% (47th)	—	4.1.9	2022-02-28	< 4.1.9
CVE-2025-24013US	—	0.51% (43rd)	—	4.5.8	2025-01-20	< 4.5.8
CVE-2022-23556US	high7.5OT elevated	0.40% (34th)	—	4.2.11	2022-12-22	< 4.2.11
CVE-2025-45406US	—	0.38% (32nd)	—	no fix	2025-07-25	≤ 4.6.2
CVE-2026-63220US	—	0.17% (6th)	—	4.7.4	2026-07-31	< 4.7.4

The flaw types (CWEs) most of these CVEs share.

CWE-20Improper Input Validation2 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type2 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')2 CVEs
CWE-209Generation of Error Message Containing Sensitive Information1 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVEs
CWE-269Improper Privilege Management1 CVEs
CWE-287Improper Authentication1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.