PT-2026-55709 · Kirilkirkov · Ecommerce-Codeigniter-Bootstrap

Leousum · Published 2026-07-04 · Updated 2026-07-04 · CVE-2026-14633

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions kirilkirkov Ecommerce-CodeIgniter-Bootstrap versions prior to 49b20f53de2b7ec34e920b11c863f1491d911a04

Description A cross site scripting issue exists in the Hidden REST API Endpoint component. A remote attacker can exploit this by manipulating the title or description arguments at the '/index.php/api/product/set' endpoint.

Recommendations Deploy patch d9785f995da77bdc62fb2d34bad5f7a162c9ad23.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-14633

Affected Products

Ecommerce-Codeigniter-Bootstrap

References · 10

• 🔥 https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/security/advisories/GHSA-8q62-q8qx-j49g · Exploit
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap/commit/d9785f995da77bdc62fb2d34bad5f7a162c9ad23 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-14633 · Security Note
• https://vuldb.com/vuln/376148 · Note
• https://github.com/kirilkirkov/Ecommerce-CodeIgniter-Bootstrap · Note
• https://vuldb.com/vuln/376148/cti · Note
• https://vuldb.com/submit/845903 · Note
• https://twitter.com/CVEnew/status/2073447432826876043 · Twitter Post
• https://twitter.com/infoflowcloud/status/2073448139281883420 · Twitter Post
• https://vuldb.com/cve/CVE-2026-14633 · Note