https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T10:29:04.350334+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343254 EUVD-2026-343254 2026-10-03T10:29:04.353115+00:00 EUVD-2026-343254 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63221 fkie_cve-2026-63221 2026-10-03T10:29:04.353151+00:00

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

 https://cve.radiocsirt.org/vuln/ghsa-c9w5-rwh3-7pm9 GHSA-c9w5-rwh3-7pm9 — CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions 2026-10-03T10:29:04.353185+00:00

Affected: Packagist: codeigniter4/framework

### Impact A SQL injection vulnerability exists in the Query Builder's `deleteBatch()` method. When `deleteBatch()` is used together with `where()` conditions, the bound values from the `WHERE` clause are substituted directly into the generated SQL **with their escape flag ignored**, so they are never escaped or quoted. If an application passes user-controlled input to `where()` before calling `deleteBatch()`, that input is interpreted as SQL rather than as a value, allowing SQL injection.

This affects only the `deleteBatch()` code path. Regular `delete()` operations escape `where()` binds correctly.

### Patches Upgrade to v4.7.4 or later.

### Workarounds If you cannot upgrade immediately:

- Strictly validate and cast values (e.g. numeric IDs) before using them in conditions - though this does not fully protect string conditions. - Do not pass user-controlled input to `where()` when using `deleteBatch()`. - For user-controlled conditions, use a normal `delete()` with Query Builder binds instead of `deleteBatch(`). - Where possible, express required matching values through the batch data and `onConstraint()` rather than as separate user-controlled `where()` clauses.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-63221 UBUNTU-CVE-2026-63221 2026-10-03T10:29:04.353222+00:00

Affected: Ubuntu:24.04:LTS: php-codeigniter-framework, Ubuntu:26.04:LTS: php-codeigniter-framework

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.