CVE-2026-14637: Deserialization in kirilkirkov Ecommerce-CodeIgniter-Bootstrap
A deserialization vulnerability exists in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap product in the getCartItems function within application/libraries/ShoppingCart.php. This vulnerability allows remote attackers to manipulate the shopping_cart argument to trigger deserialization. The vulnerability has a high severity with a CVSS score of 8.8. A patch has been identified but no specific affected or fixed versions are provided due to the product's continuous delivery model.
AI Analysis
Technical Summary
The kirilkirkov Ecommerce-CodeIgniter-Bootstrap product is affected by a deserialization vulnerability in the getCartItems function of the ShoppingCart.php library. Remote attackers can exploit this by manipulating the shopping_cart argument, leading to unsafe deserialization. The vulnerability is publicly disclosed and carries a high CVSS 4.0 score of 8.8, indicating network attack vector, no privileges or user interaction required, and high impact on availability. Due to continuous delivery with rolling releases, no explicit affected or fixed versions are available. A patch identified by commit 49b20f53de2b7ec34e920b11c863f1491d911a04 is recommended to remediate the issue.
Potential Impact
Successful exploitation allows remote attackers to cause potentially severe impact on the availability of the affected system by exploiting unsafe deserialization in the shopping cart functionality. The vulnerability requires no privileges or user interaction and can be triggered over the network, making it a significant risk.
Mitigation Recommendations
A patch addressing this vulnerability has been identified (commit 49b20f53de2b7ec34e920b11c863f1491d911a04). It is recommended to apply this patch promptly. Due to the continuous delivery model, users should track the vendor's repository or update channels for the patch. No official remediation level or advisory is provided, so monitoring the vendor's updates is advised. No other mitigations are specified.
CVE-2026-14637: Deserialization in kirilkirkov Ecommerce-CodeIgniter-Bootstrap
Description
A deserialization vulnerability exists in the kirilkirkov Ecommerce-CodeIgniter-Bootstrap product in the getCartItems function within application/libraries/ShoppingCart.php. This vulnerability allows remote attackers to manipulate the shopping_cart argument to trigger deserialization. The vulnerability has a high severity with a CVSS score of 8.8. A patch has been identified but no specific affected or fixed versions are provided due to the product's continuous delivery model.
CVSS v4.0
Score 8.8high
Affected software
cpe:2.3:a:kirilkirkov:ecommerce-codeigniter-bootstrap:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The kirilkirkov Ecommerce-CodeIgniter-Bootstrap product is affected by a deserialization vulnerability in the getCartItems function of the ShoppingCart.php library. Remote attackers can exploit this by manipulating the shopping_cart argument, leading to unsafe deserialization. The vulnerability is publicly disclosed and carries a high CVSS 4.0 score of 8.8, indicating network attack vector, no privileges or user interaction required, and high impact on availability. Due to continuous delivery with rolling releases, no explicit affected or fixed versions are available. A patch identified by commit 49b20f53de2b7ec34e920b11c863f1491d911a04 is recommended to remediate the issue.
Potential Impact
Successful exploitation allows remote attackers to cause potentially severe impact on the availability of the affected system by exploiting unsafe deserialization in the shopping cart functionality. The vulnerability requires no privileges or user interaction and can be triggered over the network, making it a significant risk.
Mitigation Recommendations
A patch addressing this vulnerability has been identified (commit 49b20f53de2b7ec34e920b11c863f1491d911a04). It is recommended to apply this patch promptly. Due to the continuous delivery model, users should track the vendor's repository or update channels for the patch. No official remediation level or advisory is provided, so monitoring the vendor's updates is advised. No other mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-03T17:24:37.659Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a49486027e9c79719b99121
Added to database: 07/04/2026, 17:52:32 UTC
Last enriched: 07/04/2026, 18:06:19 UTC
Last updated: 07/04/2026, 18:47:29 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.