CVE-2026-63221

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

• CWE-89

• https://github.com/codeigniter4/CodeIgniter4/commit/f5e463b9a3e986389ce285963e51a7f1fab6559f
• https://github.com/codeigniter4/CodeIgniter4/releases/tag/v4.7.4
• https://github.com/codeigniter4/CodeIgniter4/security/advisories/GHSA-c9w5-rwh3-7pm9

Published

Jul 31, 2026

Last Modified

Jul 31, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6318Use after free in Codecs in Google Chrome prior to 147.0.772…8.8
• CVE-2026-6319Use after free in Payments in Google Chrome on Android prior…7.5
• CVE-2026-6320The Salon Booking System – Free Version plugin for WordPress…7.5
• CVE-2026-6321fast-uri decoded percent-encoded path separators and dot seg…7.5
• CVE-2026-6322fast-uri normalize() decoded percent-encoded authority delim…7.5
• CVE-2026-63220CodeIgniter is a PHP full-stack web framework. In versions p…4.8
• CVE-2026-63222CodeIgniter is a PHP full-stack web framework. Prior to 4.7.…7.5
• CVE-2026-63223CodeIgniter is a PHP full-stack web framework. Prior to 4.7.…9.8
• CVE-2026-63226Printers and Multifunction Printers (MFPs) provided by Ricoh…6.9
• CVE-2026-63227An unrestricted SCORM file upload vulnerability in Koollab L…9.9
• CVE-2026-63228An unrestricted image upload vulnerability in Koollab LMS al…2.6
• CVE-2026-63229A pre-authentication blind SQL injection vulnerability in Ko…9.1