Description Summary:
A cross-site scripting vulnerability in the ci4ms content management system allows authenticated users to inject malicious scripts, potentially leading to unauthorized actions or data theft.

Executive Summary:
A high-severity cross-site scripting vulnerability in ci4ms, a CodeIgniter 4-based CMS, could allow authenticated attackers to execute malicious scripts within the context of other users' sessions.

Vulnerability Details

CVE-ID: CVE-2026-45270

Affected Software: ci4-cms-erp ci4ms

Affected Versions: < 0.31.9.0

Vulnerability: The application is susceptible to a Cross-site Scripting (XSS) vulnerability (CWE-79) due to improper neutralization of input during web page generation. This flaw requires the attacker to have low-level privileges (authenticated access) to successfully inject the script.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the browser of a victim, which can result in session hijacking, unauthorized data access, or defacement of the application. Given the CVSS score of 8.7, this represents a significant risk to the integrity and confidentiality of the platform, potentially compromising administrative accounts if they interact with the injected malicious content.

Remediation Plan

Immediate Action: Upgrade the ci4ms installation to version 0.31.9.0 or later as provided in the official GitHub repository.

Proactive Monitoring: Monitor web application logs for suspicious input patterns, particularly those containing script tags or encoded payloads, directed at user-accessible fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common XSS payloads, which can provide temporary protection while the update is being tested or deployed.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 21, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is fundamentally an issue of unsanitized user input rendering in the browser.

Analyst Recommendation

This vulnerability presents a substantial risk to organizational security due to the potential for session compromise. Administrators should prioritize applying the patch to version 0.31.9.0 immediately to eliminate this attack vector.

Description Summary:
CI4MS contains a stored DOM-based XSS vulnerability in the backup module that can be leveraged for full account takeover.

Executive Summary:
A stored DOM XSS vulnerability in CI4MS allows attackers to perform full account takeover and privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-41201

Affected Software: Arch CI4MS

Affected Versions: 0.31.4.0

Vulnerability: An attacker can upload a crafted SQL file containing a malicious filename that triggers stored DOM XSS when processed by the backup module. This allows for the execution of arbitrary JavaScript in the context of an administrator's session.

Business Impact

The ability to execute JavaScript in an administrator's browser leads directly to account takeover and full control over the CMS. Given the 9.1 CVSS score, this is a critical threat to the integrity and availability of the managed content and infrastructure.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.5.0 immediately.

Proactive Monitoring: Monitor application logs for suspicious file uploads or unusual backup module activity.

Compensating Controls: Implement strict file type and name validation on the server side and utilize a Content Security Policy (CSP) to mitigate the impact of XSS attacks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Administrators must update to the patched version immediately. Additionally, verify that all existing backup files are clean and that no malicious payloads have already been stored.

Description Summary:
The CI4MS CMS skeleton is vulnerable to CRLF injection via the host POST parameter in the Install controller, allowing unauthenticated attackers to modify sensitive .env configuration files.

Executive Summary:
A critical CRLF injection vulnerability in CI4MS allows unauthenticated attackers to overwrite system configuration files, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-39394

Affected Software: ci4-cms-erp ci4ms

Affected Versions: < 0.31.4.0

Vulnerability: This flaw is a CRLF injection (CWE-93) occurring in the Install::index() controller, where unsanitized input is used to update the .env configuration file. An unauthenticated attacker can trigger this by bypassing the InstallFilter during specific conditions, such as a fresh deployment or cache expiration, due to the explicit disabling of CSRF protections on install routes.

Business Impact

The ability to inject arbitrary directives into the .env file grants an attacker the power to alter database credentials, application keys, and other critical security settings. Given the CVSS score of 8.1, this vulnerability poses a severe risk of unauthorized access and total system compromise, which could result in significant data loss or operational downtime.

Remediation Plan

Immediate Action: Update the ci4ms package to version 0.31.4.0 or later immediately to incorporate the necessary input validation and security patches.

Proactive Monitoring: Review access logs for unusual POST requests directed at the installation routes and monitor the integrity of the .env file for unauthorized modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to detect and block CRLF sequences in POST parameters to prevent exploitation attempts until the application can be patched.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct manipulation of the server environment configuration.

Analyst Recommendation

Organizations utilizing CI4MS must prioritize the upgrade to version 0.31.4.0 to remediate this CRLF injection flaw. Because the vulnerability allows for the modification of environmental configuration without authentication, the risk of remote code execution or complete application takeover is high, necessitating immediate patching of all production instances.

Description Summary:
An authentication bypass vulnerability in the CI4MS setup wizard allows unauthenticated attackers to overwrite the .env file and gain full application takeover when the database is unreachable.

Executive Summary:
A critical authentication bypass flaw in the ci4ms CMS skeleton permits unauthenticated attackers to achieve full application takeover by exploiting a failed installation route guard.

Vulnerability Details

CVE-ID: CVE-2026-39393

Affected Software: ci4-cms-erp ci4ms

Affected Versions: < 0.31.4.0

Vulnerability: This vulnerability involves a missing authentication check (CWE-306) within the installation route guard. An unauthenticated attacker can trigger this flaw when the database is temporarily unreachable, causing the system to fail open and grant unauthorized access to the setup wizard.

Business Impact

The impact of this vulnerability is severe, as it facilitates full application takeover. Successful exploitation leads to total compromise of the application environment, including unauthorized access to sensitive data and potential loss of system integrity. With a CVSS score of 8.1, this represents a high-risk security event that could lead to significant operational disruption and data breach.

Remediation Plan

Immediate Action: Update the ci4ms package to version 0.31.4.0 or later immediately to resolve the installation route guard failure.

Proactive Monitoring: Monitor access logs for unauthorized requests directed at the installation or setup routes, particularly during periods of database instability.

Compensating Controls: Deploy a Web Application Firewall (WAF) to restrict access to setup or administrative installation endpoints to known, trusted management IP addresses.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 10, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its reliance on a volatile cache state for security enforcement.

Analyst Recommendation

Given the potential for full application takeover, administrators must prioritize patching this vulnerability immediately. Ensure that the ci4ms component is updated to version 0.31.4.0 and verify that the .env file permissions are restrictive to prevent unauthorized modification. Failure to remediate this issue exposes the application to a trivial authentication bypass that requires no prior user privileges.

Description Summary:
CI4MS versions prior to 0.31.0.0 suffer from insufficient session expiration, allowing deactivated user accounts to maintain persistent access until the session is manually terminated.

Executive Summary:
A critical access control vulnerability in CI4MS allows deactivated user accounts to retain unauthorized access to the system, posing a significant risk of data compromise and privilege abuse.

Vulnerability Details

CVE-ID: CVE-2026-34572

Affected Software: ci4-cms-erp ci4ms

Affected Versions: < 0.31.0.0

Vulnerability: This is an improper access control and insufficient session expiration flaw where account state changes are only validated during initial authentication, failing to invalidate established sessions for deactivated users. The vulnerability requires the attacker to be a previously authorized user whose account has since been revoked.

Business Impact

The ability for deactivated users to maintain access circumvents organizational security policies regarding offboarding and identity management. This flaw could lead to unauthorized data exposure, potential modification of sensitive records, and prolonged access by terminated employees or compromised accounts, justifying the high CVSS score of 8.8.

Remediation Plan

Immediate Action: Upgrade the CI4MS application to version 0.31.0.0 or later to implement the corrected session validation logic.

Proactive Monitoring: Review application access logs for activity associated with accounts that are known to be deactivated or disabled.

Compensating Controls: If an immediate update is not feasible, administrators should manually flush or terminate active sessions via the database or cache layer whenever an account is deactivated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 3, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw stems from a fundamental logic error in session management that assumes trust persists for the duration of a session.

Analyst Recommendation

Given the potential for unauthorized access by revoked users, organizations utilizing CI4MS must prioritize this update. Applying the fix in version 0.31.0.0 is the only reliable way to ensure that account deactivation is effectively enforced across all active sessions.

Description Summary:
A Stored Cross-Site Scripting (XSS) vulnerability in the CI4MS backend user management allows attackers to inject malicious JavaScript, leading to full administrative account compromise.

Executive Summary:
CI4MS is vulnerable to a critical stored XSS flaw in its administrative interface that allows for session hijacking and total backend takeover.

Vulnerability Details

CVE-ID: CVE-2026-34571

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: This is a Stored XSS vulnerability located in the backend user management functionality. An authenticated attacker can inject persistent JavaScript into user-controlled fields which then executes automatically when an administrator views the affected management page.

Business Impact

A successful exploit enables attackers to hijack administrative sessions, escalate privileges, and gain full control over the CMS. Despite being an XSS flaw, the CVSS score of 9.9 is justified by the direct path to full administrative compromise and system-wide impact.

Remediation Plan

Immediate Action: Update the CI4MS skeleton and associated modules to version 0.31.0.0 or higher immediately.

Proactive Monitoring: Audit backend user accounts for unauthorized additions or modifications and review access logs for suspicious administrative session activity.

Compensating Controls: Enable Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and use a WAF to filter common XSS injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 1, 2026, no active exploitation has been reported. However, the high CVSS score reflects the ease with which an internal or compromised user could take over the entire application.

Analyst Recommendation

The ability to compromise administrative accounts via stored scripts is a critical risk. Administrators must apply the version 0.31.0.0 patch immediately to secure the backend management interface.

Description Summary:
CI4MS versions prior to 0.31.0.0 are vulnerable to Stored XSS in the blog category title field, allowing malicious scripts to execute on both public and administrative pages.

Executive Summary:
A critical stored XSS vulnerability in CI4MS blog categories allows attackers to compromise both site visitors and administrative users through malicious script injection.

Vulnerability Details

CVE-ID: CVE-2026-34569

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize input when creating or editing blog categories. An attacker can inject a payload into the category title, which is then rendered without encoding on public blog pages and administrative views, facilitating a Stored XSS attack.

Business Impact

This vulnerability poses a dual threat: it can be used to hijack administrative sessions or to attack site visitors via drive-by downloads or credential harvesting. The CVSS score of 9.9 highlights the extreme risk of widespread session hijacking and site-wide compromise.

Remediation Plan

Immediate Action: Upgrade CI4MS to version 0.31.0.0 to implement necessary output encoding and input sanitization.

Proactive Monitoring: Scan the database for existing blog category titles containing <script> tags or other HTML event handlers.

Compensating Controls: Implement a robust Content Security Policy (CSP) and ensure all administrative actions require multi-factor authentication (MFA) to limit the impact of session hijacking.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 1, 2026, there are no reports of this vulnerability being used in active attacks. However, because the payload triggers on public-facing pages, the reach of this exploit is significantly larger than typical backend XSS.

Analyst Recommendation

Due to the high CVSS score and the public-facing nature of the vulnerability, immediate patching is the only viable solution. Organizations must update to version 0.31.0.0 to protect their users and their administrative integrity.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the CI4MS CMS allows attackers to inject and execute malicious JavaScript payloads via blog post content.

Executive Summary:
A stored XSS vulnerability in CI4MS allows unauthorized actors to inject malicious scripts into blog posts, potentially leading to full session compromise for visiting users.

Vulnerability Details

CVE-ID: CVE-2026-34568

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to properly sanitize user-controlled input within the blog post creation/editing module. This results in stored XSS, where malicious scripts are executed in the browsers of users viewing the compromised content.

Business Impact

With a CVSS score of 9.1, this vulnerability poses a high risk of session hijacking, cookie theft, and unauthorized redirection of users. Successful exploitation could allow an attacker to gain elevated privileges if an administrator views the malicious content, leading to a complete compromise of the CMS.

Remediation Plan

Immediate Action: Update the CI4MS installation to version 0.31.0.0, which includes necessary input sanitization and output encoding improvements.

Proactive Monitoring: Monitor web application logs for unusual script tags or character sequences in blog post submissions and review browser console errors for potential XSS triggers.

Compensating Controls: Deploy a robust Web Application Firewall (WAF) configured to detect and block common XSS payloads in HTTP request bodies.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Stored XSS is a high-impact vulnerability that can be used to bypass client-side security controls. Administrators should expedite the patching process to version 0.31.0.0 to ensure that all user-supplied input is correctly neutralized before rendering.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in the CI4MS Categories section allows attackers to inject malicious scripts that execute when categories are viewed.

Executive Summary:
A stored XSS vulnerability in the CI4MS Categories module allows attackers to inject malicious code that executes in the context of other users' browsers.

Vulnerability Details

CVE-ID: CVE-2026-34567

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application lacks sufficient output encoding for user-supplied data in the Categories section. Malicious JavaScript injected into categories is stored server-side and executed whenever those categories are rendered within the application.

Business Impact

The CVSS score of 9.1 highlights the critical nature of this flaw, as it allows attackers to compromise the integrity of the user experience. Successful exploitation could lead to the theft of session tokens, unauthorized performative actions, or the delivery of malicious content to administrative users.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.0.0, as this release remediates the underlying sanitization failures in the Categories module.

Proactive Monitoring: Audit existing category descriptions for injected scripts and monitor traffic for anomalous patterns involving the Categories management interface.

Compensating Controls: Utilize Content Security Policy (CSP) headers to restrict the sources from which scripts can be executed, significantly reducing the impact of stored XSS.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS severity, this vulnerability should be addressed immediately. Upgrading to version 0.31.0.0 is the only reliable method to ensure that input sanitization and output encoding are correctly applied across all vulnerable modules in the CMS.

Description Summary:
CI4MS versions prior to 0.31.0.0 are vulnerable to stored cross-site scripting (XSS) via unsanitized input in the Page Management functionality.

Executive Summary:
A stored cross-site scripting vulnerability in the CI4MS Page Management module allows attackers to execute arbitrary JavaScript in administrative and public-facing contexts.

Vulnerability Details

CVE-ID: CVE-2026-34566

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: This is a stored cross-site scripting (XSS) vulnerability where the Page Management functionality fails to sanitize user-controlled input. An authenticated attacker can inject malicious JavaScript payloads that are executed when the content is rendered in administrative or public views.

Business Impact

Successful exploitation permits an attacker to hijack user sessions, perform unauthorized administrative actions, or deface public-facing pages. Given the CVSS score of 9.1, this vulnerability poses a severe risk to organizational integrity and data confidentiality, as it can lead to full compromise of user accounts within the CMS.

Remediation Plan

Immediate Action: Upgrade the CI4MS installation to version 0.31.0.0 or later to ensure proper output encoding is implemented.

Proactive Monitoring: Review web server and application logs for suspicious input patterns, particularly those containing script tags or encoded payloads, within page management requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to inspect and block malicious payloads directed at the CMS input fields.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The severity of this vulnerability necessitates an immediate update to version 0.31.0.0. Organizations should prioritize patching to prevent potential session hijacking and unauthorized administrative access stemming from this high-impact XSS flaw.

Description Summary:
CI4MS versions prior to 0.31.0.0 contain a stored cross-site scripting (XSS) vulnerability within the Menu Management functionality when adding Posts.

Executive Summary:
An authenticated stored cross-site scripting vulnerability in the CI4MS Menu Management feature exposes administrative and public users to malicious JavaScript execution.

Vulnerability Details

CVE-ID: CVE-2026-34565

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize post-related data when adding content to navigation menus. This allows an attacker to store malicious JavaScript payloads that execute unsafely within both administrative dashboards and public-facing navigation menus.

Business Impact

The ability to inject scripts into navigation menus threatens the security of both backend administrators and frontend users. With a CVSS score of 9.1, this vulnerability allows for severe impact, including unauthorized data access and potential escalation of privileges via session theft.

Remediation Plan

Immediate Action: Apply the vendor-provided patch by upgrading the CI4MS application to version 0.31.0.0.

Proactive Monitoring: Monitor administrative audit logs for unusual changes to navigation menus or post associations that could indicate an injection attempt.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources as a temporary mitigation.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this XSS vulnerability, immediate remediation is required. Administrators should verify that all affected CI4MS instances are updated to version 0.31.0.0 to eliminate the injection vector and secure the navigation menu subsystem.

Description Summary:
CI4MS versions prior to 0.31.0.0 are susceptible to stored cross-site scripting (XSS) due to improper input sanitization in the Menu Management functionality.

Executive Summary:
A critical stored cross-site scripting vulnerability in CI4MS Menu Management allows for the injection of malicious payloads into navigation menus, impacting administrative and public users.

Vulnerability Details

CVE-ID: CVE-2026-34564

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: This vulnerability occurs when page-related data is added to navigation menus without proper output encoding. An attacker can store malicious JavaScript payloads that execute upon rendering in administrative interfaces or public-facing menus.

Business Impact

Exploitation of this flaw could result in the compromise of administrative sessions or the delivery of malicious content to end-users. The CVSS score of 9.1 reflects the high risk of widespread impact on the integrity and security of the CMS environment.

Remediation Plan

Immediate Action: Update the CI4MS software to version 0.31.0.0 to resolve the underlying sanitization failure.

Proactive Monitoring: Review application performance and error logs for signs of script injection or unexpected behavior in the navigation menu generation process.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out common JavaScript patterns from input fields until the software can be successfully updated.

Exploitation Status

Public Exploit Available: Not specified

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

It is imperative that affected organizations update to CI4MS version 0.31.0.0 immediately. Failure to patch may allow attackers to leverage this vulnerability to gain unauthorized access or manipulate content delivered to legitimate users.

Description Summary:
A stored blind cross-site scripting (XSS) vulnerability in CI4MS allows attackers to inject malicious JavaScript via backup filenames, which executes when viewed in backup management.

Executive Summary:
A stored Blind XSS vulnerability in CI4MS allows unauthorized script execution, potentially compromising administrative sessions and user data.

Vulnerability Details

CVE-ID: CVE-2026-34563

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize input within backup filenames during the upload process. An attacker can inject malicious payloads that are stored server-side and executed when an authenticated administrator accesses the backup management interface.

Business Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of an administrator’s browser session. This can lead to session hijacking, unauthorized configuration changes, or the exfiltration of sensitive application data. With a CVSS score of 9.1, this vulnerability poses a critical risk to the integrity and confidentiality of the CMS.

Remediation Plan

Immediate Action: Upgrade the CI4MS installation to version 0.31.0.0 or later to implement required input sanitization and output encoding.

Proactive Monitoring: Audit application logs for suspicious characters or script tags within backup metadata fields.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common XSS patterns in file upload requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this stored XSS flaw, immediate patching is required to prevent potential compromise of administrative accounts. Organizations should prioritize upgrading to version 0.31.0.0 and review existing backups for any signs of malicious injection.

Description Summary:
A stored blind XSS vulnerability in the CI4MS logs interface allows attackers to execute malicious scripts when an administrator views the application logs.

Executive Summary:
CI4MS contains a stored Blind XSS vulnerability in its logging system, enabling potential malicious script execution within administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-34560

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to properly encode log data before rendering it in the logs interface. Attackers can inject malicious payloads into application logs, which execute once an administrator navigates to the log management dashboard.

Business Impact

This vulnerability enables attackers to perform actions on behalf of administrators, potentially leading to a full system compromise. The high CVSS score of 9.1 underscores the severity of allowing arbitrary code execution within the administrative control panel. Failure to remediate could result in significant data breaches or loss of administrative control.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.0.0 to ensure proper output encoding of all logged data.

Proactive Monitoring: Regularly review log files for anomalous entries containing script tags or unexpected characters.

Compensating Controls: Restrict access to the administrative logs interface to trusted IP addresses and utilize a WAF to filter malicious payloads from incoming requests.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The vulnerability represents a critical risk due to its ability to target administrative users through standard system monitoring interfaces. Applying the vendor-provided patch is the only effective way to mitigate this risk and ensure the security of the management console.

Description Summary:
A stored cross-site scripting (XSS) vulnerability in CI4MS allows attackers to inject malicious scripts into blog tags, executing in public and administrative interfaces.

Executive Summary:
A stored XSS vulnerability in CI4MS blog tags allows for the execution of malicious scripts, threatening both public users and administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-34559

Affected Software: CI4MS

Affected Versions: Prior to 0.31.0.0

Vulnerability: The application fails to sanitize input for blog tag creation and editing. These payloads are stored in the database and subsequently rendered without encoding on both public-facing pages and internal administrative dashboards.

Business Impact

This vulnerability allows attackers to compromise both public visitors and internal administrators. Potential impacts include credential theft, redirection to malicious sites, and unauthorized administrative actions, justifying the 9.1 CVSS score. Such widespread exposure threatens both brand reputation and the security of the underlying CMS infrastructure.

Remediation Plan

Immediate Action: Upgrade to version 0.31.0.0 to apply necessary input sanitization and output encoding for blog tags.

Proactive Monitoring: Scan existing blog tags for suspicious content and review web access logs for unusual requests targeting the tagging functionality.

Compensating Controls: Implement a Content Security Policy (CSP) to restrict the execution of inline scripts and unauthorized external resources.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Apr 1, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability affects both public and administrative interfaces, it is highly critical and requires immediate attention. Administrators must update to the latest version and verify that all existing tags are free of malicious payloads to fully secure the application.

Description Summary:
CI4MS is vulnerable to Stored DOM-Based Cross-Site Scripting in its Methods Management functionality, allowing for script execution in administrative and global navigation components.

Executive Summary:
Critical Stored DOM-Based XSS in CI4MS’s Methods Management allows attackers to execute malicious scripts across the administrative interface and global navigation.

Vulnerability Details

CVE-ID: CVE-2026-34558

Affected Software: CI4MS CI4MS

Affected Versions: Prior to version 0.31.0.0

Vulnerability: The application fails to sanitize input when creating or managing application methods/pages. Attacker-controlled JavaScript payloads are stored server-side and later rendered directly into the DOM of administrative interfaces and global navigation components without proper output encoding.

Business Impact

Because the malicious payloads are rendered in global navigation components, this vulnerability has a wide impact across the entire administrative console. Attackers can perform unauthorized actions on behalf of administrators, leading to full site compromise. The CVSS score of 9.1 reflects the high risk of session hijacking and data manipulation.

Remediation Plan

Immediate Action: Update CI4MS to version 0.31.0.0 immediately to ensure all method-related inputs are properly sanitized and encoded before being rendered in the DOM.

Proactive Monitoring: Audit the "Methods Management" entries for suspicious script tags and monitor for unauthorized changes to site navigation or permissions.

Compensating Controls: Deploy a WAF to filter out common XSS payloads in POST requests and enforce a strict CSP to mitigate the impact of DOM-based script execution.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation. This vulnerability is particularly dangerous as it affects global components, increasing the likelihood of a successful administrative compromise.

Analyst Recommendation

Applying the 0.31.0.0 update is critical for maintaining the security of the CI4MS environment. Organizations should also perform a retrospective audit of their methods and pages to ensure no malicious payloads were introduced prior to patching.

Description Summary:
CI4MS is vulnerable to stored Cross-Site Scripting (XSS) in its group and role management functionality, allowing attackers to execute malicious scripts in administrative views.

Executive Summary:
A critical stored XSS vulnerability in CI4MS allows attackers to compromise administrative sessions by injecting malicious JavaScript into group and role management fields.

Vulnerability Details

CVE-ID: CVE-2026-34557

Affected Software: CI4MS CI4MS

Affected Versions: Prior to version 0.31.0.0

Vulnerability: The application fails to sanitize input in three distinct group-related fields within the RBAC management module. Malicious payloads are stored on the server and rendered without encoding in privileged administrative views, enabling stored Cross-Site Scripting (XSS).

Business Impact

This vulnerability can be used to hijack administrative sessions, steal CSRF tokens, or redirect administrators to malicious websites. Given the high CVSS score of 9.1, this stored XSS is considered critical because it targets the most privileged users of the CMS, potentially leading to a full application takeover.

Remediation Plan

Immediate Action: Upgrade CI4MS to version 0.31.0.0 or higher to implement proper input sanitization and output encoding for the affected management fields.

Proactive Monitoring: Inspect the database for existing JavaScript payloads in group and role tables and monitor for unusual administrative browser activity.

Compensating Controls: Implement a strong Content Security Policy (CSP) to prevent the execution of unauthorized inline scripts and restrict script sources.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation. Stored XSS in administrative interfaces is a common vector for persistent administrative account compromise.

Analyst Recommendation

The severity of this XSS flaw necessitates an immediate update to version 0.31.0.0. Security teams should also verify that no malicious scripts have already been stored in the database prior to the update.

Description Summary:
An authenticated user with file editor permissions in CI4MS can achieve Remote Code Execution (RCE) by uploading and executing arbitrary PHP code via insecure file endpoints.

Executive Summary:
CI4MS is vulnerable to a critical Remote Code Execution (RCE) flaw that allows authenticated users to execute arbitrary PHP code and gain full server control.

Vulnerability Details

CVE-ID: CVE-2026-25510

Affected Software: CI4MS CMS

Affected Versions: Prior to version 0.28.5.0

Vulnerability: The vulnerability exists in the file creation and save endpoints of the CMS. An authenticated attacker with "file editor" permissions can bypass restrictions to create or modify PHP files on the server, leading to code execution.

Business Impact

While this requires authentication, the CVSS score of 9.9 indicates that the impact is nearly total. Successful exploitation grants the attacker the ability to execute any command with the privileges of the web server, potentially leading to data exfiltration, installation of persistent backdoors, or lateral movement within the hosting environment.

Remediation Plan

Immediate Action: Update CI4MS to version 0.28.5.0 or later to implement proper security checks on file management operations.

Proactive Monitoring: Review file system changes in the web root for new or modified .php files and audit the activities of users with file editor privileges.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) and disable the file editor functionality in production environments if it is not strictly necessary.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 3, 2026, there is no public information indicating active exploitation. The requirement for authentication slightly reduces the risk compared to unauthenticated RCE, but the severity remains critical.

Analyst Recommendation

The primary recommendation is to apply the security patch immediately. Additionally, organizations should adopt the principle of least privilege, ensuring only highly trusted administrators have file-editing capabilities, and consider using file integrity monitoring (FIM) tools.