- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 36 · 17 critical, 7 high, 12 medium
- Registry
- Packagist
Advisories 36
- CVE-2026-45270High 8.7
CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule
Affected: fixed in 0.31.9.0.
- CVE-2026-45139Medium 6.5
CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations
Affected: fixed in 0.31.9.0.
- CVE-2026-45138Medium 5.4
CI4MS: Stored XSS in Blog Content via Broken `html_purify` Validation Rule
Affected: fixed in 0.31.9.0.
- CVE-2026-41891Medium 5.3
CI4MS: Deactivated User Session Bypass (active=0)
Affected: from 0.26.0, fixed in 0.31.8.0.
- CVE-2026-41890Medium 6.9
CI4MS: Arbitrary Database Table Drop via Theme deleteProcess
Affected: from 0.31.1.0, fixed in 0.31.8.0.
- CVE-2026-41203Critical 9.4
ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE
Affected: fixed in 0.31.5.0.
- CVE-2026-41202Critical 9.4
ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE
Affected: fixed in 0.31.5.0.
- CVE-2026-41201Critical 9.1
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2
Affected: fixed in 0.31.5.0.
- CVE-2026-41587High 8.6
CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution
Affected: from 0.26.0.0, fixed in 0.31.7.0.
- CVE-2026-39394High 8.1
CI4MS has an .env CRLF Injection via Unvalidated `host` Parameter in Install Controller
Affected: fixed in 0.31.4.0.
- CVE-2026-39393High 8.1
Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms
Affected: fixed in 0.31.4.0.
- CVE-2026-39392Medium 5.5
CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization
Affected: fixed in 0.31.4.0.
- CVE-2026-39391Medium 4.8
CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List
Affected: fixed in 0.31.4.0.
- CVE-2026-39390Medium 5.5
CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting
Affected: fixed in 0.31.4.0.
- CVE-2026-39389Medium 6.7
CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files
Affected: fixed in 0.31.4.0.
Show all 36 advisoriesShow fewer advisories
- CVE-2026-35035High 7.2
CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via…
Affected: fixed in 0.31.2.0.
- CVE-2026-34989Critical 9.4
CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 31.0.0.0.
- CVE-2026-34572High 8.8
CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Affected: fixed in 0.31.0.0.
- CVE-2026-34571Critical 10.0
CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account…
Affected: fixed in 0.31.0.0.
- CVE-2026-34570High 8.8
CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw)
Affected: fixed in 0.31.0.0.
- CVE-2026-34569Critical 10.0
CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34568Critical 9.1
CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34567Critical 9.1
CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34566Critical 9.1
CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34565Critical 9.1
CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34564Critical 9.1
CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34563Critical 9.1
CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34562Medium 4.7
CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via…
Affected: fixed in 0.31.0.0.
- CVE-2026-34561Medium 4.7
CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via…
Affected: fixed in 0.31.0.0.
- CVE-2026-34560Critical 9.1
CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34559Critical 9.1
CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34558Critical 9.1
CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-34557Critical 9.1
CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS
Affected: fixed in 0.31.0.0.
- CVE-2026-27599Medium 4.7
CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored…
Affected: fixed in 0.31.0.0.
- CVE-2026-25510Critical 10.0
CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor
Affected: fixed in 0.28.5.0.
- CVE-2026-25509Medium 5.3
CI4MS Vulnerable to User Email Enumeration via Password Reset Flow
Affected: fixed in 0.28.5.0.