Vulnerabilities

Filters

Reset all

2 selected

27 records

Sort

Vendor: ci4-cms-erp Component: Ci4ms Clear all filters

TI-2026-28379 CVE-2026-39394 · GHSA-vfhx-5459-qhqh

CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00525 Published 2026-04-08 Fixed in 0.31.4.0 CWE-93

TI-2026-28378 CVE-2026-39393 · GHSA-8rh5-4mvx-xj7j

Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

HIGH 70

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00428 Published 2026-04-08 Fixed in 0.31.4.0 CWE-306

TI-2026-28377 CVE-2026-39392 · GHSA-fjpj-6qcq-6pw2

CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization

MEDIUM 58

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00251 Published 2026-04-08 Fixed in 0.31.4.0 CWE-79

TI-2026-28376 CVE-2026-39391 · GHSA-7cm9-v848-cfh2

CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List

MEDIUM 55

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00235 Published 2026-04-08 Fixed in 0.31.4.0 CWE-79

TI-2026-28375 CVE-2026-39390 · GHSA-x3hr-cp7x-44r2

CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting

MEDIUM 58

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00239 Published 2026-04-08 Fixed in 0.31.4.0 CWE-79

TI-2026-28374 CVE-2026-39389 · GHSA-9rxp-f27p-wv3h

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

HIGH 67

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0049 Published 2026-04-08 Fixed in 0.31.4.0 CWE-285

TI-2026-27238 CVE-2026-35035 · GHSA-5ghq-42rg-769x

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 74

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00463 Published 2026-04-06 Fixed in 0.31.2.0 CWE-79

TI-2026-27211 CVE-2026-34989 · GHSA-vr2g-rhm5-q4jr

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00302 Published 2026-04-06 Fixed in 31.0.0.0 CWE-79

TI-2026-26821 CVE-2026-34572 · GHSA-8fq3-c5w3-pj3q

Improper access control in ci4-cms-erp ci4ms

HIGH 73

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00511 Published 2026-04-01 Fixed in 0.31.0.0 CWE-1254

TI-2026-26820 CVE-2026-34571 · GHSA-fc4p-p49v-r948

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.004 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26819 CVE-2026-34570 · GHSA-4vxv-4xq4-p84h

Improper access control in ci4-cms-erp ci4ms

HIGH 79

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00511 Published 2026-04-01 Fixed in 0.31.0.0 CWE-1254

TI-2026-26818 CVE-2026-34569 · GHSA-fhrf-q333-82fm

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0033 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26817 CVE-2026-34568 · GHSA-x7wh-g25g-53vg

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00323 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26816 CVE-2026-34567 · GHSA-r33w-c82v-x5v7

CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26815 CVE-2026-34566 · GHSA-458r-h248-29c5

CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26814 CVE-2026-34565 · GHSA-xgh5-w62m-8mpr

CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26813 CVE-2026-34564 · GHSA-g4pp-fhgf-8653

CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00312 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26812 CVE-2026-34563 · GHSA-85m8-g393-jcxf

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26811 CVE-2026-34562 · GHSA-v897-c6vq-6cr3

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00279 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26810 CVE-2026-34561 · GHSA-gcfj-cf7j-vwgj

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 70

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00233 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26809 CVE-2026-34560 · GHSA-r4v5-rwr2-q7r4

CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00387 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26808 CVE-2026-34559 · GHSA-4333-387x-w245

CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.0033 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26807 CVE-2026-34558 · GHSA-v77r-xg3p-75g7

CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00319 Published 2026-03-30 Fixed in 0.31.0.0 CWE-79

TI-2026-26806 CVE-2026-34557 · GHSA-rpjr-985c-qhvm

CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00319 Published 2026-03-30 Fixed in 0.31.0.0 CWE-79

TI-2026-21985 CVE-2026-27599 · GHSA-66m2-v9v9-95c3

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 65

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00372 Published 2026-03-30 Fixed in 0.31.0.0 CWE-79