by Kastro
Paper/Archive/CVE-2026-34571

CVE-2026-34571

ci4-cms-erp ci4ms — CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account Compromise

EPSS 0.4%public exploitCVSS 10.0
critical.is priorityof 100
47
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 34.2.342 × 206.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, a Stored Cross-Site Scripting (Stored XSS) vulnerability exists in the backend user management functionality. The application fails to properly sanitize user-controlled input before rendering it in the administrative interface, allowing attackers to inject persistent JavaScript code. This results in automatic execution whenever backend users access the affected page, enabling session hijacking, privilege escalation, and full administrative account compromise. This issue has been patched in version 0.31.0.0.

Affected

ProductAffectedFixed inSource
ci4ms< 0.31.0.0–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/ci4-cms-erp/ci4ms/security/advisories/GHSA-fc4p-p49v-r948refgithub.com/ci4-cms-erp/ci4ms/releases/tag/0.31.0.0