CVE-2013-4891

MediumCVSS 6.1/10Last modified Jun 16, 2026

Description

The xss_clean function in CodeIgniter before 2.1.4 might allow remote attackers to bypass an intended protection mechanism and conduct cross-site scripting (XSS) attacks via an unclosed HTML tag.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/bcit-ci/CodeIgniter/issues/4020Issue Tracking, Third Party Advisory
https://nealpoole.com/blog/2013/07/codeigniter-21-xss-clean-filter-bypass/Exploit, Third Party Advisory
https://www.codeigniter.com/userguide2/changelog.htmlRelease Notes
https://github.com/bcit-ci/CodeIgniter/issues/4020Issue Tracking, Third Party Advisory
https://nealpoole.com/blog/2013/07/codeigniter-21-xss-clean-filter-bypass/Exploit, Third Party Advisory
https://www.codeigniter.com/userguide2/changelog.htmlRelease Notes

Timeline

Published: Feb 21, 2018
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-48986.5Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authen CVE-2013-48994.3Cross-site scripting (XSS) vulnerability in Twilight CMS 5.17 and possibly earlier allows remote attackers to inject arbitrary web script or CVE-2013-49005.0Directory traversal vulnerability in DeWeS web server 0.4.2 and possibly earlier, as used in Twilight CMS, allows remote attackers to read a CVE-2013-49116.8Cross-site request forgery (CSRF) vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to hijack the CVE-2013-49125.8Open redirect vulnerability in Siemens WinCC (TIA Portal) 11 and 12 before 12 SP1 allows remote attackers to redirect users to arbitrary web CVE-2013-49205.0The P1 dissector in Wireshark 1.10.x before 1.10.1 does not properly initialize a global variable, which allows remote attackers to cause a CVE-2013-49215.0Off-by-one error in the dissect_radiotap function in epan/dissectors/packet-ieee80211-radiotap.c in the Radiotap dissector in Wireshark 1.10 CVE-2013-49225.0Double free vulnerability in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActiv CVE-2013-49235.0Memory leak in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector CVE-2013-49245.0epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly validate cer CVE-2013-49255.0Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 al CVE-2013-49265.0epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly determine wh