{"id":"CVE-2025-45406","aliases":["EUVD-2025-22731","GHSA-49jm-g4m8-x53p"],"status":"disputed","title":"Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter","description":"A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00377,"percentile":0.32022,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2025-07-25T00:00:00Z","modified":"2026-09-10T03:50:57Z","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15943","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7h5r-54mm-w4pq"},{"url":"https://www.exploit-db.com/exploits/50556","tags":["web"]},{"url":"https://medium.com/@talktoshweta0/when-debugging-bites-back-exposing-a-persistent-xss-in-codeigniter4-c9caf804a190","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-45406","tags":["advisory"]},{"url":"https://github.com/codeigniter4/CodeIgniter4/blob/v4.6.2/system/Debug/Toolbar.php#L496","tags":["web"]},{"url":"https://github.com/codeigniter4/framework/blob/v4.6.2/system/Debug/Toolbar.php#L496","tags":["web"]},{"url":"https://github.com/advisories/GHSA-49jm-g4m8-x53p"},{"url":"https://github.com/codeigniter4/CodeIgniter4","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-45406","description":"A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.","status":"disputed","published":"2025-07-25T00:00:00Z","modified":"2025-07-29T12:40:49.13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:36.385228Z"}],"euvd":[{"id":"EUVD-2025-22731","description":"A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.","status":"published","published":"2025-07-25T00:00:00Z","modified":"2025-07-29T12:40:49Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:03.359865Z"}],"ghsa":[{"id":"GHSA-49jm-g4m8-x53p","title":"Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862.\n\n### Original Description\nA stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter.","status":"withdrawn","published":"2025-07-25T18:30:41Z","modified":"2025-07-29T14:30:18Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:51.864708Z"}],"nvd":[{"id":"CVE-2025-45406","description":"A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbar_time, and because debugbar-related data is automatically escaped by the CodeIgniter Parser class.","status":"disputed","published":"2025-07-25T17:15:32.19Z","modified":"2026-06-17T09:25:30.397Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:11:21.132141Z"}],"osv":[{"id":"GHSA-49jm-g4m8-x53p","title":"Withdrawn Advisory: CodeIgniter4 Cross-Site Scripting Vulnerability in debugbar_time Parameter","description":"### Withdrawn Advisory\nThis advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://github.com/github/advisory-database/pull/5862.\n\n### Original Description\nA stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_time parameter.","status":"withdrawn","published":"2025-07-25T18:30:41Z","modified":"2026-09-10T03:50:57.807249719Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.782754Z"}]}}