PT-2026-55708 · Kirilkirkov · Ecommerce-Codeigniter-Bootstrap

Leousum · Published 2026-07-04 · Updated 2026-07-04 · CVE-2026-14632

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions up to 95dfa8cebbb87ab46ae450643a07241274a74dce

Description An open redirect issue exists in the Trusted Backend Interface component. The setReferrer() function within the application/core/MY Controller.php file does not properly handle the href argument, allowing a remote attacker to manipulate it to redirect users to an external site.

Recommendations Apply patch 213babdbaa949e94557246414db0130e01394517. As a temporary mitigation, restrict access to the setReferrer() function.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-14632

Affected Products

Ecommerce-Codeigniter-Bootstrap

References · 9

• 🔥 https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-x9pg-hvpj-9q44 · Exploit
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/213babdbaa949e94557246414db0130e01394517 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-14632 · Security Note
• https://vuldb.com/vuln/376147/cti · Note
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap · Note
• https://vuldb.com/vuln/376147 · Note
• https://twitter.com/CVEnew/status/2073447434512978279 · Twitter Post
• https://vuldb.com/cve/CVE-2026-14632 · Note
• https://vuldb.com/submit/845900 · Note