CVE-2026-14637: kirilkirkov Ecommerce CodeIgniter Bootstrap ShoppingCart deserialization risk

Summary

A security issue exists in the kirilkirkov Ecommerce CodeIgniter Bootstrap shopping cart system. If exploited, an attacker could access sensitive information or take control of the system. To fix this, apply the available patch to ensure the system is secure.

What to do

No fix is available yet. Check with your software vendor for updates.

Affected software

Vendor	Product	Affected versions
kirilkirkov	ecommerce-codeigniter-bootstrap	13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7

Original title

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the li...

Original description

A security vulnerability has been detected in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 13fd582aaf49aeab7438acc0fc3eb973a1f5e6a7. The affected element is the function getCartItems in the library application/libraries/ShoppingCart.php. The manipulation of the argument shopping_cart leads to deserialization. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The identifier of the patch is 49b20f53de2b7ec34e920b11c863f1491d911a04. It is recommended to apply a patch to fix this issue.

nvd CVSS2.0 8.5

nvd CVSS3.1 8.2

nvd CVSS4.0 7.8

Vulnerability type

CWE-20 Improper Input Validation

CWE-502 Deserialization of Untrusted Data