PT-2025-30909 · Unknown · Codeigniter4

Talktoshweta0

·

CVE-2025-45406

·

Published

2025-07-25

·

Updated

2025-07-29

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions CodeIgniter4 version 4.6.0
Description A stored cross-site scripting (XSS) vulnerability exists in CodeIgniter4. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the debugbar time parameter.
Recommendations Update to a newer version that contains a fix for this issue. As a temporary workaround, sanitize the debugbar time parameter to prevent the injection of malicious scripts.

Fix

XSS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-45406
GHSA-49JM-G4M8-X53P

Affected Products

Codeigniter4