Riskcovery

CVE-2026-14634

kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site scripting

State
Published
Severity
5.3 Medium
Published
Jul 4, 2026
Updated
Jul 6, 2026
Reserved
Jul 3, 2026

Read the record on cve.org

Description

A vulnerability was identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 213babdbaa949e94557246414db0130e01394517. This vulnerability affects the function checkForPostRequests of the file application/core/MY_Controller.php of the component Subscribed Emails Admin Page. Such manipulation of the argument User-Agent leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The name of the patch is 23105f25dadf57b4314fc015a63a7c6e910c89df. It is advisable to implement a patch to correct this issue.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:PVulDB
3.14.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:CVulDB
3.04.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:CVulDB
2.05.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:CVulDB

Weaknesses

Affected Products

ProductVersions
Ecommerce-CodeIgniter-Bootstrapkirilkirkov
  • 213babdbaa949e94557246414db0130e01394517Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.