VulnSocial

CVE-2026-63221Patch

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-89

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-31); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-31: 1Mentions · 2026-09-16: 1Patch / Workaround · 2026-07-31: 1Technical Details · 2026-07-31: 1Technical Details · 2026-09-16: 107-3109-16
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets1 URL
By indicator
Classification over time
DateTotalLabels
2026-07-311
Patch1
2026-09-161
Disclosure1
Full discourse2 posts
  • IntegSec@integ_sec
    Disclosure

    CVE-2026-63221: CodeIgniter SQL Injection Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04xDXsH0

    Post summary

    The text announces a CodeIgniter SQL injection vulnerability but provides no evidence of PoC availability, exploit tooling, active exploitation, or a specific remediation.

    0000031
    34 followersView on X
  • ADK Cyber@ADKCyber
    Patch

    CVE-2026-63221 (CVSS 9.4) impacts CodeIgniter 4.3.0-4.7.3 Query Builder. Organizations using the framework should review and patch promptly. via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability https://t.co/UseYlZLIiH

    Post summary

    The tweet announces a high‑severity CVE affecting CodeIgniter Query Builder and urges users to patch promptly, without detailing exploitation or providing a PoC.

    0000046
    90 followersView on X

Explore more

Back to dashboard