ci4-cms-erp/ci4ms vulnerabilities (Packagist)
36 vulnerabilities.
ci4-cms-erp/ci4msPackagistCI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule8.7 Highci4-cms-erp/ci4msPackagistCI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations6.5 Mediumci4-cms-erp/ci4msPackagistCI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule5.4 Mediumci4-cms-erp/ci4msPackagistCI4MS: Deactivated User Session Bypass (active=0)5.3 Mediumci4-cms-erp/ci4msPackagistCI4MS: Arbitrary Database Table Drop via Theme deleteProcess6.9 Mediumci4-cms-erp/ci4msPackagistCI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution8.6 Highci4-cms-erp/ci4msPackagistci4ms Theme::upload is vulnerable to Zip Slip leading to RCE9.4 Criticalci4-cms-erp/ci4msPackagistci4ms Backup::restore is vulnerable to Zip Slip leading to RCE9.4 Criticalci4-cms-erp/ci4msPackagistCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 29.1 Criticalci4-cms-erp/ci4msPackagistCI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller8.1 Highci4-cms-erp/ci4msPackagistPost-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms8.1 Highci4-cms-erp/ci4msPackagistCI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization5.5 Mediumci4-cms-erp/ci4msPackagistCI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List4.8 Mediumci4-cms-erp/ci4msPackagistCI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting5.5 Mediumci4-cms-erp/ci4msPackagistCI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files6.7 Mediumci4-cms-erp/ci4msPackagistCI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS7.2 Highci4-cms-erp/ci4msPackagistCI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.4 Criticalci4-cms-erp/ci4msPackagistCI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)8.8 Highci4-cms-erp/ci4msPackagistCI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise10.0 Criticalci4-cms-erp/ci4msPackagistCI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)8.8 Highci4-cms-erp/ci4msPackagistCI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS10.0 Criticalci4-cms-erp/ci4msPackagistCI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS4.7 Mediumci4-cms-erp/ci4msPackagistCI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS4.7 Mediumci4-cms-erp/ci4msPackagistCI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS9.1 Criticalci4-cms-erp/ci4msPackagistCI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS4.7 Mediumci4-cms-erp/ci4msPackagistCI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor10.0 Criticalci4-cms-erp/ci4msPackagistCI4MS Vulnerable to User Email Enumeration via Password Reset Flow5.3 Medium