Stored Cross-Site Scripting Vulnerability in CodeIgniter4 by CodeIgniter

CVE-2025-45406

What is CVE-2025-45406?

A stored cross-site scripting (XSS) vulnerability exists in CodeIgniter4 version 4.6.0, caused by insufficient input validation. Attackers can leverage this flaw to inject malicious scripts into the 'debugbar_time' parameter. When users interact with the compromised application, the malicious code executes in their browser, potentially leading to data theft, session hijacking, and other serious security breaches. It is crucial for developers using this framework to implement appropriate security measures and patch this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References