CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

Port details

www/codeigniter3.1.13

Framework for developing PHP web applications

19
unaddressed
0
VuXML only, still affected
15
fixed
Maintainer
ports@FreeBSD.org
Packages
codeigniter 3.1.13
Upstream
Higher version available: 4.6.4
CPE
codeigniter:codeigniter from the port
WWW
https://codeigniter.com/
Links
cgit · VuXML

Unaddressed (19) · The CVE record lists this version as affected, no VuXML entry names the CVE

Updating to 4.5.8 would fix 5 of 19 unaddressed CVEs, according to the CVE records.
Fixed up to each version, cumulative: 4.2.3 1 · 4.3.5 2 · 4.4.3 3 · 4.4.7 4 · 4.5.8 5
CVE-2023-326929.82023-05-30CodeIgniter is a PHP full-stack web framework. This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders. The vulnerability exis…
CVE-2022-408269.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_having() function. Note: Multiple third part…
CVE-2022-408279.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where() function. Note: Multiple third parties …
CVE-2022-408289.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_not_in() function. Note: Multiple thir…
CVE-2022-408299.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_like() function. Note: Multiple third partie…
CVE-2022-408309.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_not_in() function. Note: Multiple third p…
CVE-2022-408319.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php like() function. Note: Multiple third parties h…
CVE-2022-408329.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php having() function. Note: Multiple third parties…
CVE-2022-408339.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where_in() function. Note: Multiple third pa…
CVE-2022-408349.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_not_like() function. Note: Multiple third pa…
CVE-2022-408359.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php. Note: Multiple third parties have disputed thi…
CVE-2022-408249.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php or_where() function. Note: Multiple third parti…
CVE-2022-408259.82022-10-07B.C. Institute of Technology CodeIgniter <=3.1.13 is vulnerable to SQL Injection via system\database\DB_query_builder.php where_in() function. Note: Multiple third parti…
CVE-2020-107938.82020-03-23CodeIgniter through 4.0.0 allows remote attackers to gain privileges via a modified Email ID to the "Select Role of the User" page. NOTE: A contributor to the CodeIgnite…
CVE-2024-413447.52024-10-15A Cross-Site Request Forgery (CSRF) in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges.
CVE-2024-299047.52024-03-29CodeIgniter is a PHP full-stack web framework A vulnerability was found in the Language class that allowed DoS attacks. This vulnerability can be exploited by an attacke…
CVE-2023-462407.52023-10-31CodeIgniter is a PHP full-stack web framework. Prior to CodeIgniter4 version 4.4.3, if an error or exception occurs, a detailed error report is displayed even if in the …
CVE-2022-359435.92022-08-12Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypa…
CVE-2025-240135.32025-01-20CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can construct d…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (15)

Show 15 fixed
VuXML entries whose affected range this version has left.

Commits (67)

Olli Hauer (ohauer) · 2.0.3_1
- bump PORTREVISION from ports if USE_APACHE=13+ or 20+ is defined
7a0bd31763
Greg Larkin (glarkin) · 2.0.3
- Renamed www/codeigniter-devel to www/codeigniter by updating to version   2.0.3 here - Added CONFLICTS for www/codeigniter17

Approved by:	appleboy.tw@gmail.com (maintainer)
5d2c9934ef
Greg Larkin (glarkin) · 1.7.3
- Updated to 1.7.3 - Removed Upload class patch file - now included in 1.7.3

Version 1.7.3 is a security maintenance release, including a
previously patched file Upload class, and a new security fix
to prevent possible directory traversal in certain circumstances.
There are no other significant changes.

PR:		ports/152878
Submitted by:	Bo-Yi Wu <appleboy dot tw at gmail dot com>
3c45613cb4
Greg Larkin (glarkin) · 1.7.2_1
- Incorporate vendor patch for file upload class vulnerability - Bump PORTREVISION

Security:	http://codeigniter.com/news/codeigniter_1.7.2_security_patch/
Security:	0502c1cb-8f81-11df-a0bb-0050568452ac
00bba7ddc0
Alex Dupre (ale) · 1.7.2
PHP dropped support for Oracle8 client library.
2288ee2ec6
Greg Larkin (glarkin) · 1.7.2
- Updated to 1.7.2

PR:		ports/138848
Submitted by:	appleboy <appleboy.tw@gmail.com>
Feature safe:	yes
f62325f253
Greg Larkin (glarkin) · 1.7.1
- Update to 1.7.1

Security:	83574d5a-f828-11dd-9fdf-0050568452ac
Security:	http://codeigniter.com/bug_tracker/bug/6068/
bfba2128b9
Greg Larkin (glarkin) · 1.7.0
- Updated to 1.7.0 - Added MASTER_SITES for redundancy
b7dc23f441
Greg Larkin (glarkin) · 1.6.3
Changed my MAINTAINER address to glarkin@FreeBSD.org.

Approved by:	beech (mentor)
bb3d8a2d71
Beech Rintoul (beech) · 1.6.3
- Update to 1.6.3 - Added informational messages about user-configurable files that   may need merging after a port upgrade

PR:		ports/125217
Submitted by:	Greg Larkin <glarkin@sourcehosting.net> (maintainer)
c8e608dcc6
Martin Wilke (miwi) · 1.6.2
- Update to 1.6.2

PR:		123856
Submitted by:	Greg Larkin <glarkin@sourcehosting.net> (maintainer)
8362204426
Stanislav Sedov (stas) · 1.6.1
- Remove empty file.

Pontyhat to:	beech
69d8b1d8dc
Beech Rintoul (beech) · 1.6.1
- Update to 1.6.1 - Found all of the CI files that could be modified by the user and   install .sample versions of each - Add an informational message when a user-editable config file is   modified and the port is deinstalled (e.g. the file is preserved) - Display different pkg-message depending on WITH_APACHE knob

PR:		ports/121358
Submitted by:	Greg Larkin <glarkin@sourcehosting.net> (maintainer)
f5ab2b774b
Beech Rintoul (beech) · 1.5.4
- Fix master_sites

PR:		ports/120153
Reported by:	pointyhat via pav
Approved by:	Greg Larkin <glarkin@sourcehosting.net> (maintainer)
72ba1ecff6
Martin Wilke (miwi) · 1.5.4
- Update MASTER_SITES

PR:		119861
Submitted by:	Greg Larkin <glarkin@sourcehosting.net> (maintainer)
70d3afb3cb
Beech Rintoul (beech) · 1.5.4
- Fix master_sites (changed)

Reported by:	pointyhat via pav
Approved by:	linimon (mentor)
fda752e9de
Beech Rintoul (beech) · 1.5.4
- New port codeigniter-1.5.4

- CodeIgniter is a powerful PHP framework with a very small
footprint, built for PHP coders who need a simple and elegant toolkit
to create full-featured web applications.

PR:		ports/119347
Submitted by:	Greg Larkin <glarkin@sourcehosting.net> (maintainer)
Approved by:	linimon (mentor)
831caccd0b
« newest← newerpage 2 of 2