Skip to content
Ci4-cms-erp Ci4ms vulnerabilities
-
ci4-cms-erp ci4ms
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
CVE-2026-45270
Fix available
8.7 High
-
ci4-cms-erp ci4ms
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
CVE-2026-45139
Fix available
6.5 Medium
-
ci4-cms-erp ci4ms
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
CVE-2026-45138
Fix available
5.4 Medium
-
ci4-cms-erp ci4ms
CI4MS: Deactivated User Session Bypass (active=0)
CVE-2026-41891
Fix available
5.3 Medium
-
ci4-cms-erp ci4ms
CI4MS: Arbitrary Database Table Drop via Theme deleteProcess
CVE-2026-41890
Fix available
6.9 Medium
-
ci4-cms-erp ci4ms
CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution
CVE-2026-41587
Fix available
8.6 High
-
ci4-cms-erp ci4ms
ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE
CVE-2026-41203
Fix available
9.4 Critical
-
ci4-cms-erp ci4ms
ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE
CVE-2026-41202
Fix available
9.4 Critical
-
ci4-cms-erp ci4ms
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2
CVE-2026-41201
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
CVE-2026-39394
Fix available
8.1 High
-
ci4-cms-erp ci4ms
Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms
CVE-2026-39393
Fix available
8.1 High
-
ci4-cms-erp ci4ms
CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization
CVE-2026-39392
Fix available
5.5 Medium
-
ci4-cms-erp ci4ms
CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List
CVE-2026-39391
Fix available
4.8 Medium
-
ci4-cms-erp ci4ms
CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting
CVE-2026-39390
Fix available
5.5 Medium
-
ci4-cms-erp ci4ms
CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
CVE-2026-39389
Fix available
6.7 Medium
-
ci4-cms-erp ci4ms
CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via System Settings Company Information Stored DOM XSS
CVE-2026-35035
Fix available
7.2 High
-
ci4-cms-erp ci4ms
CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34989
Fix available
9.4 Critical
-
ci4-cms-erp ci4ms
CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
CVE-2026-34572
Fix available
8.8 High
-
ci4-cms-erp ci4ms
CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise
CVE-2026-34571
Fix available
10.0 Critical
-
ci4-cms-erp ci4ms
CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
CVE-2026-34570
Fix available
8.8 High
-
ci4-cms-erp ci4ms
CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34569
Fix available
10.0 Critical
-
ci4-cms-erp ci4ms
CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34568
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34567
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34566
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34565
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34564
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS
CVE-2026-34563
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34562
Fix available
4.7 Medium
-
ci4-cms-erp ci4ms
CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34561
Fix available
4.7 Medium
-
ci4-cms-erp ci4ms
CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34560
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34559
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34558
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-34557
Fix available
9.1 Critical
-
ci4-cms-erp ci4ms
CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
CVE-2026-27599
Fix available
4.7 Medium
-
ci4-cms-erp ci4ms
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
CVE-2026-25510
Fix available
10.0 Critical
-
ci4-cms-erp ci4ms
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
CVE-2026-25509
Fix available
5.3 Medium