Deserialization Vulnerability in Ecommerce-CodeIgniter-Bootstrap by kirilkirkov
CVE-2026-14637

8.8HIGH

Key Information:

Vendor: Kirilkirkov
Status: Ecommerce-codeigniter-bootstrap
Vendor: CVE Published:; 4 July 2026

🔔 Create Kirilkirkov Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-14637?

A deserialization vulnerability has been identified in the Ecommerce-CodeIgniter-Bootstrap framework, specifically affecting the getCartItems function in the ShoppingCart.php library. This issue allows for remote manipulation of the shopping_cart argument, potentially enabling attackers to execute unauthorized actions. The vulnerability affects versions up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7, and continuous delivery practices may complicate the release of detailed versioning. It is crucial for users to apply the patch identified by commit 49b20f53de2b7ec34e920b11c863f1491d911a04 to mitigate this risk.

Affected Version(s)

Ecommerce-CodeIgniter-Bootstrap 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-14637 - Proof of Concept