PT-2025-30909 · Unknown · Codeigniter4

Talktoshweta0 · Published 2025-07-25 · Updated 2025-07-29 · CVE-2025-45406

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter4 version 4.6.0

Description A stored cross-site scripting (XSS) vulnerability exists in CodeIgniter4. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the debugbar time parameter.

Recommendations Update to a newer version that contains a fix for this issue. As a temporary workaround, sanitize the debugbar time parameter to prevent the injection of malicious scripts.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-45406

GHSA-49JM-G4M8-X53P

Affected Products

Codeigniter4

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2020-15943 · Security Note
• https://osv.dev/vulnerability/GHSA-49jm-g4m8-x53p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-45406 · Security Note
• https://github.com/codeigniter4/CodeIgniter4 · Note
• https://github.com/codeigniter4/CodeIgniter4/blob/v4.6.2/system/Debug/Toolbar.php#L496 · Note
• https://github.com/codeigniter4/framework/blob/v4.6.2/system/Debug/Toolbar.php#L496 · Note
• https://exploit-db.com/exploits/50556 · Note
• https://twitter.com/CVEnew/status/1948794753342210515 · Twitter Post
• https://medium.com/@talktoshweta0/when-debugging-bites-back-exposing-a-persistent-xss-in-codeigniter4-c9caf804a190 · Note
• https://twitter.com/michalsn/status/1950219503364620466 · Twitter Post
• https://t.me/cveNotify/130112 · Telegram Post
• https://github.com/advisories/GHSA-7h5r-54mm-w4pq · Note