Vulnerabilities

Filters

1 selected

36 records

Sort

Vendor: ci4-cms-erp Clear all filters

TI-2026-33072 CVE-2026-45270 · GHSA-gqr2-7hcg-rchf

CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule

HIGH 71

CI4MS is a CodeIgniter 4-based content management system skeleton.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00262 Published 2026-07-20 Fixed in 0.31.9.0 CWE-79

TI-2026-32972 CVE-2026-45139 · GHSA-245j-xjvr-xvm5

CI4MS Fileeditor allows deletion and rename of critical application files due to missing…

MEDIUM 64

CI4MS is a CodeIgniter 4-based content management system skeleton.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00322 Published 2026-07-20 Fixed in 0.31.9.0 CWE-73

TI-2026-32971 CVE-2026-45138 · GHSA-2m69-jmvh-6chr

CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule

MEDIUM 58

CI4MS is a CodeIgniter 4-based content management system skeleton.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00175 Published 2026-07-19 Fixed in 0.31.9.0 CWE-79

TI-2026-30294 CVE-2026-41891 · GHSA-5hfv-c864-qcq9

CI4MS: Deactivated User Session Bypass (active=0)

LOW 24

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00269 Published 2026-05-07 Fixed in 0.31.8.0 CWE-613

TI-2026-30293 CVE-2026-41890 · GHSA-vgrf-pr28-vf98

CI4MS: Arbitrary Database Table Drop via Theme deleteProcess

HIGH 70

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00409 Published 2026-05-07 Fixed in 0.31.8.0 CWE-20

TI-2026-29823 CVE-2026-41203 · GHSA-xv3r-vr59-95rg

ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.0062 Published 2026-05-07 Fixed in 0.31.5.0 CWE-22

TI-2026-29822 CVE-2026-41202 · GHSA-xp9f-pvvc-57p4

ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00677 Published 2026-05-07 Fixed in 0.31.5.0 CWE-22

TI-2026-29821 CVE-2026-41201 · GHSA-qxpq-82f3-xj47

CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2

MEDIUM 41

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00331 Published 2026-05-07 Fixed in 0.31.5.0 CWE-79

TI-2026-30140 CVE-2026-41587 · GHSA-fw49-9xq4-gmx6

CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution

HIGH 78

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.00623 Published 2026-05-07 Fixed in 0.31.7.0 CWE-434

TI-2026-28379 CVE-2026-39394 · GHSA-vfhx-5459-qhqh

CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00525 Published 2026-04-08 Fixed in 0.31.4.0 CWE-93

TI-2026-28378 CVE-2026-39393 · GHSA-8rh5-4mvx-xj7j

Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms

HIGH 70

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00428 Published 2026-04-08 Fixed in 0.31.4.0 CWE-306

TI-2026-28377 CVE-2026-39392 · GHSA-fjpj-6qcq-6pw2

CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization

MEDIUM 58

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00251 Published 2026-04-08 Fixed in 0.31.4.0 CWE-79

TI-2026-28376 CVE-2026-39391 · GHSA-7cm9-v848-cfh2

CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List

MEDIUM 55

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00235 Published 2026-04-08 Fixed in 0.31.4.0 CWE-79

TI-2026-28375 CVE-2026-39390 · GHSA-x3hr-cp7x-44r2

CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting

MEDIUM 58

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1MEDIUM 5.5 Network High privileges No interaction EPSS 0.00239 Published 2026-04-08 Fixed in 0.31.4.0 CWE-79

TI-2026-28374 CVE-2026-39389 · GHSA-9rxp-f27p-wv3h

CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files

HIGH 67

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0049 Published 2026-04-08 Fixed in 0.31.4.0 CWE-285

TI-2026-27238 CVE-2026-35035 · GHSA-5ghq-42rg-769x

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 74

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00463 Published 2026-04-06 Fixed in 0.31.2.0 CWE-79

TI-2026-27211 CVE-2026-34989 · GHSA-vr2g-rhm5-q4jr

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00302 Published 2026-04-06 Fixed in 31.0.0.0 CWE-79

TI-2026-26821 CVE-2026-34572 · GHSA-8fq3-c5w3-pj3q

Improper access control in ci4-cms-erp ci4ms

HIGH 73

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00511 Published 2026-04-01 Fixed in 0.31.0.0 CWE-1254

TI-2026-26820 CVE-2026-34571 · GHSA-fc4p-p49v-r948

Cross-site scripting in ci4-cms-erp ci4ms

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.004 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26819 CVE-2026-34570 · GHSA-4vxv-4xq4-p84h

Improper access control in ci4-cms-erp ci4ms

HIGH 79

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00511 Published 2026-04-01 Fixed in 0.31.0.0 CWE-1254

TI-2026-26818 CVE-2026-34569 · GHSA-fhrf-q333-82fm

CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 76

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.0033 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26817 CVE-2026-34568 · GHSA-x7wh-g25g-53vg

CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00323 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26816 CVE-2026-34567 · GHSA-r33w-c82v-x5v7

CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26815 CVE-2026-34566 · GHSA-458r-h248-29c5

CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79

TI-2026-26814 CVE-2026-34565 · GHSA-xgh5-w62m-8mpr

CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

HIGH 72

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-01 Fixed in 0.31.0.0 CWE-79