ci4-cms-erp

Records36All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical20CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

ci4-cms-erp records in CISA KEV

No ci4-cms-erp vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Ci4ms 27 records HIGH

Records

36 records

TI-2026-26819 CVE-2026-34570 · GHSA-4vxv-4xq4-p84h

Improper access control in ci4-cms-erp ci4ms

HIGH 79

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00511 Published 2026-04-01 Fixed in 0.31.0.0 CWE-1254

TI-2026-30140 CVE-2026-41587 · GHSA-fw49-9xq4-gmx6

CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution

HIGH 78

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00623 Published 2026-05-07 Fixed in 0.31.7.0 CWE-434

TI-2026-29823 CVE-2026-41203 · GHSA-xv3r-vr59-95rg

ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.0062 Published 2026-05-07 Fixed in 0.31.5.0 CWE-22

TI-2026-29822 CVE-2026-41202 · GHSA-xp9f-pvvc-57p4

ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00677 Published 2026-05-07 Fixed in 0.31.5.0 CWE-22

TI-2026-28379 CVE-2026-39394 · GHSA-vfhx-5459-qhqh

CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00525 Published 2026-04-08 Fixed in 0.31.4.0 CWE-93

TI-2026-27211 CVE-2026-34989 · GHSA-vr2g-rhm5-q4jr

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00302 Published 2026-04-06 Fixed in 31.0.0.0 CWE-79

TI-2026-26820 CVE-2026-34571 · GHSA-fc4p-p49v-r948

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.004 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26818 CVE-2026-34569 · GHSA-fhrf-q333-82fm

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0033 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-27238 CVE-2026-35035 · GHSA-5ghq-42rg-769x

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 74

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00463 Published 2026-04-06 Fixed in 0.31.2.0 CWE-79

TI-2026-26821 CVE-2026-34572 · GHSA-8fq3-c5w3-pj3q

Improper access control in ci4-cms-erp ci4ms

HIGH 73

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00511 Published 2026-04-01 Fixed in 0.31.0.0 CWE-1254

TI-2026-26817 CVE-2026-34568 · GHSA-x7wh-g25g-53vg

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00323 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26816 CVE-2026-34567 · GHSA-r33w-c82v-x5v7

CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26815 CVE-2026-34566 · GHSA-458r-h248-29c5

CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26814 CVE-2026-34565 · GHSA-xgh5-w62m-8mpr

CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26813 CVE-2026-34564 · GHSA-g4pp-fhgf-8653

CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00312 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26812 CVE-2026-34563 · GHSA-85m8-g393-jcxf

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26811 CVE-2026-34562 · GHSA-v897-c6vq-6cr3

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00279 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26809 CVE-2026-34560 · GHSA-r4v5-rwr2-q7r4

CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00387 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26808 CVE-2026-34559 · GHSA-4333-387x-w245

CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.0033 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26807 CVE-2026-34558 · GHSA-v77r-xg3p-75g7

CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00319 Published 2026-03-30 Fixed in 0.31.0.0 CWE-79

TI-2026-26806 CVE-2026-34557 · GHSA-rpjr-985c-qhvm

CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00319 Published 2026-03-30 Fixed in 0.31.0.0 CWE-79

TI-2026-33072 CVE-2026-45270 · GHSA-gqr2-7hcg-rchf

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

HIGH 71

CI4MS is a CodeIgniter 4-based content management system skeleton.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00262 Published 2026-07-20 Fixed in 0.31.9.0 CWE-79

TI-2026-30293 CVE-2026-41890 · GHSA-vgrf-pr28-vf98

CI4MS: Arbitrary Database Table Drop via Theme deleteProcess

HIGH 70

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00409 Published 2026-05-07 Fixed in 0.31.8.0 CWE-20

TI-2026-28378 CVE-2026-39393 · GHSA-8rh5-4mvx-xj7j

Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

HIGH 70

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00428 Published 2026-04-08 Fixed in 0.31.4.0 CWE-306

TI-2026-26810 CVE-2026-34561 · GHSA-gcfj-cf7j-vwgj

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 70

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00233 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

Open these records in search →