Unknown · Codeigniter4 · CVE-2025-45406
**Name of the Vulnerable Software and Affected Versions**
CodeIgniter4 version 4.6.0
**Description**
A stored cross-site scripting (XSS) vulnerability exists in CodeIgniter4. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the `debugbar time` parameter.
**Recommendations**
Update to a newer version that contains a fix for this issue. As a temporary workaround, sanitize the `debugbar time` parameter to prevent the injection of malicious scripts.