Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-14632— kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect

Quick assessment

Affected
kirilkirkov Ecommerce-CodeIgniter-Bootstrap
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kiril Kirkov Ecommerce-CodeIgniter-Bootstrap是Kiril Kirkov个人开发者的一个基于CodeIgniter和Bootstrap构建的多商户、多语言电子商务平台。 kirilkirkov Ecommerce-CodeIgniter-Bootstrap存在输入验证错误漏洞，该漏洞源于Trusted Backend Interface组件存在开放重定向问题，通过操作application/core/MY_Controller.php文件中setReferrer函

CVSS 4.3 · Medium EPSS 0.46% · P40

Possible ATT&CK Techniques 1 AI

T1189 · Drive-by Compromise

Affected Version Matrix 1

VendorProduct Version RangeStatus
kirilkirkov Ecommerce-CodeIgniter-Bootstrap 95dfa8cebbb87ab46ae450643a07241274a74dce affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14632

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
kirilkirkov Ecommerce-CodeIgniter-Bootstrap Trusted Backend MY_Controller.php setReferrer redirect
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 95dfa8cebbb87ab46ae450643a07241274a74dce. Affected by this issue is the function setReferrer of the file application/core/MY_Controller.php of the component Trusted Backend Interface. The manipulation of the argument href results in open redirect. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The patch is identified as 213babdbaa949e94557246414db0130e01394517. A patch should be applied to remediate this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
kirilkirkov Ecommerce-CodeIgniter-Bootstrap 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kiril Kirkov Ecommerce-CodeIgniter-Bootstrap是Kiril Kirkov个人开发者的一个基于CodeIgniter和Bootstrap构建的多商户、多语言电子商务平台。 kirilkirkov Ecommerce-CodeIgniter-Bootstrap存在输入验证错误漏洞，该漏洞源于Trusted Backend Interface组件存在开放重定向问题，通过操作application/core/MY_Controller.php文件中setReferrer函
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
kirilkirkov Ecommerce-CodeIgniter-Bootstrap 95dfa8cebbb87ab46ae450643a07241274a74dce cpe:2.3:a:kirilkirkov:ecommerce-codeigniter-bootstrap:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-14632

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14632

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-14632 (1)

Vendor Advisories for CVE-2026-14632 (1)

Other References for CVE-2026-14632 (1)

Same Patch Batch · kirilkirkov · 2026-07-04 · 6 CVEs total

CVE-2026-14637 8.2 HIGH kirilkirkov Ecommerce-CodeIgniter-Bootstrap ShoppingCart.php getCartItems deserialization
CVE-2026-14635 7.3 HIGH kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Multi-Image Endpoint AddProduct.php pat
CVE-2026-14636 5.4 MEDIUM kirilkirkov Ecommerce-CodeIgniter-Bootstrap Vendor Image Manager AddProduct.php do_upload_
CVE-2026-14633 4.3 MEDIUM kirilkirkov Ecommerce-CodeIgniter-Bootstrap Hidden REST API Endpoint set cross site script
CVE-2026-14634 4.3 MEDIUM kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php chec

IV. Related Vulnerabilities

Same product: Ecommerce-CodeIgniter-Bootstrap
Same vendor: kirilkirkov
Same weakness: CWE-601