{"kind": "product", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "name": "ci4-cms-erp/ci4ms", "product": "ci4-cms-erp/ci4ms", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-45270", "noindex": false, "published": "2026-07-20T14:12:13.093Z", "modified": "2026-07-20T15:11:27.452Z", "cvss": 8.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "severity": "high", "epss": 0.00262, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45270", "title": "CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule", "description": "CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-gqr2-7hcg-rchf", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-45270"], "fixes": ["0.31.9.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45139", "noindex": false, "published": "2026-07-20T13:58:39.800Z", "modified": "2026-07-20T16:40:55.398Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "severity": "medium", "epss": 0.00322, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45139", "title": "CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations", "description": "CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Databa", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-245j-xjvr-xvm5", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-45139"], "fixes": ["0.31.9.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45138", "noindex": false, "published": "2026-07-19T23:18:51.312Z", "modified": "2026-07-20T13:18:54.966Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00175, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45138", "title": "CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule", "description": "CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the custom `html_purify` validation rule used to sanitize blog post bodies relies on by-reference mutation (`?string &$str`), but CodeIgniter 4's validator passes a local copy of the value, so the sanitized text is silently discarded. The Blog controller writes `$lanData['content']` directly into `blog_langs.content`, and the public template echoes it without escaping — yielding stored XSS executable in any visitor's browser, including the superadmin when previewing or editing posts. Version 0.31.9.0 patches the issue.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-2m69-jmvh-6chr", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.9.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-45138"], "fixes": ["0.31.9.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41891", "noindex": false, "published": "2026-05-07T03:24:43.940Z", "modified": "2026-05-07T12:47:44.069Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00269, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41891", "title": "CI4MS: Deactivated User Session Bypass (active=0)", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0 to before version 0.31.8.0, the auth filter has the deactivated/banned user check commented out. This issue has been patched in version 0.31.8.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-5hfv-c864-qcq9", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-41891"], "fixes": ["0.31.8.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41890", "noindex": false, "published": "2026-05-07T03:23:31.339Z", "modified": "2026-05-07T13:42:35.440Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00409, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41890", "title": "CI4MS: Arbitrary Database Table Drop via Theme deleteProcess", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.31.1.0 to before version 0.31.8.0, the deleteProcess() action accepts a POST parameter tables[] containing arbitrary table names. These are passed directly to $forge->dropTable() without validating that the tables belong to the theme being deleted. The deleteConfirm view correctly populates tables[] from the theme's own migration files, but the server-side deleteProcess does not verify the received values against those files. An authenticated admin can craft a POST request with arbitrary ", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vgrf-pr28-vf98", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.8.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-41890"], "fixes": ["0.31.8.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41203", "noindex": false, "published": "2026-05-07T03:19:45.786Z", "modified": "2026-05-07T13:49:58.012Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.0062, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41203", "title": "ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Theme::upload extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the theme create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root. This issue has been patched in version 0.31.5.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-xv3r-vr59-95rg", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-41203"], "fixes": ["0.31.5.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41202", "noindex": false, "published": "2026-05-07T03:18:00.849Z", "modified": "2026-05-07T12:40:03.386Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00677, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41202", "title": "ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.5.0, ci4ms Backup::restore extracts user uploaded ZIP archives without validating entry names, allowing an authenticated backend user with the backup create permission to write files to arbitrary filesystem locations (Zip Slip) and achieve remote code execution by dropping a PHP file under the public web root. This issue has been patched in version 0.31.5.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-xp9f-pvvc-57p4", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-41202"], "fixes": ["0.31.5.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41201", "noindex": false, "published": "2026-05-07T03:16:41.280Z", "modified": "2026-05-07T14:07:34.294Z", "cvss": 9.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.00331, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41201", "title": "CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. In version 0.31.4.0, an attacker can achieve Full Account Takeover & Privilege Escalation via Stored DOM XSS in backup module filename field manipulated via a sql file that tampers with the file name field to contain hidden XSS payload. This issue has been patched in version 0.31.5.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-qxpq-82f3-xj47", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.5.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-41201"], "fixes": ["0.31.5.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-41587", "noindex": false, "published": "2026-05-07T03:14:38.631Z", "modified": "2026-05-07T13:43:20.471Z", "cvss": 8.6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00623, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-41587", "title": "CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. From version 0.26.0.0 to before version 0.31.7.0, a theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution (RCE) by uploading a crafted ZIP file. PHP files inside the ZIP are installed into the web-accessible public/ directory with no extension or content filtering, making them directly executable via HTTP. This issue has been patched in version 0.31.7.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fw49-9xq4-gmx6", "https://github.com/ci4-cms-erp/ci4ms/commit/b969465e71eacd9eb57014ad1fce1fc34fa7bca0", "https://nvd.nist.gov/vuln/detail/CVE-2026-41587"], "fixes": ["0.31.7.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-39394", "noindex": false, "published": "2026-04-08T14:32:31.680Z", "modified": "2026-04-08T16:13:10.966Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00516, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-39394", "title": "CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST parameter without any validation and passes it directly into updateEnvSettings(), which writes it into the .env file via preg_replace(). Because newline characters in the value are not stripped, an attacker can inject arbitrary configuration directives into the .env file. The install routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when cache('settings') is empty (cache expiry or fresh deployment", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vfhx-5459-qhqh", "https://nvd.nist.gov/vuln/detail/CVE-2026-39394"], "fixes": ["0.31.4.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-39393", "noindex": false, "published": "2026-04-08T14:31:44.692Z", "modified": "2026-04-10T20:29:43.521Z", "cvss": 8.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00421, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-39393", "title": "Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the install route guard in ci4ms relies solely on a volatile cache check (cache('settings')) combined with .env file existence to block post-installation access to the setup wizard. When the database is temporarily unreachable during a cache miss (TTL expiry or admin-triggered cache clear), the guard fails open, allowing an unauthenticated attacker to overwrite the .env file with attacker-controlled database credentials, achieving full application takeover. This vulnerability is fixed", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8rh5-4mvx-xj7j", "https://nvd.nist.gov/vuln/detail/CVE-2026-39393"], "fixes": ["0.31.4.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-39392", "noindex": false, "published": "2026-04-08T14:30:59.132Z", "modified": "2026-04-08T16:05:26.652Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00247, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-39392", "title": "CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Pages module does not apply the html_purify validation rule to content fields during create and update operations, while the Blog module does. Page content is stored unsanitized in the database and rendered as raw HTML on the public frontend via echo $pageInfo->content. An authenticated admin with page-editing privileges can inject arbitrary JavaScript that executes in the browser of every public visitor viewing the page. This vulnerability is fixed in 0.31.4.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fjpj-6qcq-6pw2", "https://nvd.nist.gov/vuln/detail/CVE-2026-39392"], "fixes": ["0.31.4.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-39391", "noindex": false, "published": "2026-04-08T14:30:18.750Z", "modified": "2026-04-08T15:18:08.667Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.0023, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-39391", "title": "CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the blacklist (ban) note parameter in UserController::ajax_blackList_post() is stored in the database without sanitization and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of any other admin who views the user management page. This vulnerability is fixed in 0.31.4.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-7cm9-v848-cfh2", "https://nvd.nist.gov/vuln/detail/CVE-2026-39391"], "fixes": ["0.31.4.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-39390", "noindex": false, "published": "2026-04-08T14:29:28.500Z", "modified": "2026-04-08T16:13:16.580Z", "cvss": 5.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00235, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-39390", "title": "CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Google Maps iframe setting (cMap field) in compInfosPost() sanitizes input using strip_tags() with an <iframe> allowlist and regex-based removal of on\\w+ event handlers. However, the srcdoc attribute is not an event handler and passes all filters. An attacker with admin settings access can inject an <iframe srcdoc=\"...\"> payload with HTML-entity-encoded JavaScript that executes in the context of the parent page when rendered to unauthenticated frontend visitors. This vulnerability", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-x3hr-cp7x-44r2", "https://nvd.nist.gov/vuln/detail/CVE-2026-39390"], "fixes": ["0.31.4.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-39389", "noindex": false, "published": "2026-04-08T14:28:29.847Z", "modified": "2026-04-10T20:28:55.783Z", "cvss": 6.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "severity": "medium", "epss": 0.00471, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-39389", "title": "CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0,  This vulnerability is fixed in 0.31.4.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-9rxp-f27p-wv3h", "https://nvd.nist.gov/vuln/detail/CVE-2026-39389"], "fixes": ["0.31.4.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-35035", "noindex": false, "published": "2026-04-06T16:49:10.176Z", "modified": "2026-04-08T14:26:39.894Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00455, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-35035", "title": "CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.2.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding. These values are persisted in the database and rendered unsafely on public-facing pages only, such as the main landing page. There is no execution in the administrative dashboard—the vulnerability only impacts the public fr", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-5ghq-42rg-769x", "https://nvd.nist.gov/vuln/detail/CVE-2026-35035"], "fixes": ["0.31.2.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-34989", "noindex": false, "published": "2026-04-06T16:25:54.285Z", "modified": "2026-04-07T16:00:10.965Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00297, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-34989", "title": "CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 31.0.0.0, the application fails to properly sanitize user-controlled input when users update their profile name (e.g., full name / username). An attacker can inject a malicious JavaScript payload into their profile name, which is then stored server-side. This stored payload is later rendered unsafely in multiple application views without proper output encoding, leading to stored cross-site scripting (XSS). This vulnerability is fixed in 31.0.0.0.", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-vr2g-rhm5-q4jr", "https://nvd.nist.gov/vuln/detail/CVE-2026-34989"], "fixes": ["31.0.0.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-34572", "noindex": false, "published": "2026-04-01T21:35:10.556Z", "modified": "2026-04-02T13:51:10.563Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00511, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-34572", "title": "CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deactivated. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deactivated accounts to retain indefinite acce", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-8fq3-c5w3-pj3q", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-34572"], "fixes": ["0.31.0.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-34571", "noindex": false, "published": "2026-04-01T21:32:16.629Z", "modified": "2026-04-02T16:23:34.783Z", "cvss": 10, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "severity": "critical", "epss": 0.004, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-34571", "title": "CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has be", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fc4p-p49v-r948", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-34571"], "fixes": ["0.31.0.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-34570", "noindex": false, "published": "2026-04-01T21:30:31.415Z", "modified": "2026-04-06T17:15:53.691Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00511, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-34570", "title": "CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)", "description": "CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when an account is deleted. Due to a logic flaw in the backend design, account state changes are enforced only during authentication (login), not for already-established sessions. The system implicitly assumes that authenticated users remain trusted for the lifetime of their session. There is no session expiration or account expiration mechanism in place, causing deleted accounts to retain indefinite access until", "references": ["https://github.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-4vxv-4xq4-p84h", "https://github.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0", "https://nvd.nist.gov/vuln/detail/CVE-2026-34570"], "fixes": ["0.31.0.0"], "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}]}], "total": 36, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "ci4-cms-erp/ci4ms", "path": "vulns/packagist/ci4-cms-erp%2Fci4ms", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["0.35.0.0", "0.34.1.0", "0.34.0.0", "0.33.2.0", "0.33.1.0", "0.32.0.0", "0.31.11.0", "0.31.10.0", "0.31.9.0", "0.31.9", "0.31.8.0", "0.31.7.0"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-07-20T16:40:55.398Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}