# ci4-cms-erp/ci4ms (Packagist) vulnerabilities 36 known vulnerabilities (17 critical, 7 high, 12 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/ci4-cms-erp/ci4ms ## Advisories (36) ### [CVE-2026-45270](https://cve.now/CVE-2026-45270): CI4MS: Stored XSS in Pages Module Content via Broken html\_purify Validation Rule - Severity: High 8.7 - Published: Jul 20, 2026 - Affected: fixed in 0.31.9.0. ### [CVE-2026-45139](https://cve.now/CVE-2026-45139): CI4MS Fileeditor allows deletion and rename of critical application files due to missing extension allowlist on destructive operations - Severity: Medium 6.5 - Published: Jul 20, 2026 - Affected: fixed in 0.31.9.0. ### [CVE-2026-45138](https://cve.now/CVE-2026-45138): CI4MS: Stored XSS in Blog Content via Broken \`html\_purify\` Validation Rule - Severity: Medium 5.4 - Published: Jul 19, 2026 - Affected: fixed in 0.31.9.0. ### [CVE-2026-41891](https://cve.now/CVE-2026-41891): CI4MS: Deactivated User Session Bypass (active=0) - Severity: Medium 5.3 - Published: May 7, 2026 - Affected: from 0.26.0, fixed in 0.31.8.0. ### [CVE-2026-41890](https://cve.now/CVE-2026-41890): CI4MS: Arbitrary Database Table Drop via Theme deleteProcess - Severity: Medium 6.9 - Published: May 7, 2026 - Affected: from 0.31.1.0, fixed in 0.31.8.0. ### [CVE-2026-41203](https://cve.now/CVE-2026-41203): ci4ms Theme::upload is vulnerable to Zip Slip leading to RCE - Severity: Critical 9.4 - Published: May 7, 2026 - Affected: fixed in 0.31.5.0. ### [CVE-2026-41202](https://cve.now/CVE-2026-41202): ci4ms Backup::restore is vulnerable to Zip Slip leading to RCE - Severity: Critical 9.4 - Published: May 7, 2026 - Affected: fixed in 0.31.5.0. ### [CVE-2026-41201](https://cve.now/CVE-2026-41201): CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 - Severity: Critical 9.1 - Published: May 7, 2026 - Affected: fixed in 0.31.5.0. ### [CVE-2026-41587](https://cve.now/CVE-2026-41587): CI4MS: Unrestricted PHP File Upload via Theme Installation Leads to Authenticated Remote Code Execution - Severity: High 8.6 - Published: May 7, 2026 - Affected: from 0.26.0.0, fixed in 0.31.7.0. ### [CVE-2026-39394](https://cve.now/CVE-2026-39394): CI4MS has an .env CRLF Injection via Unvalidated \`host\` Parameter in Install Controller - Severity: High 8.1 - Published: Apr 8, 2026 - Affected: fixed in 0.31.4.0. ### [CVE-2026-39393](https://cve.now/CVE-2026-39393): Post-Installation Re-entry via Cache-Dependent Install Guard Bypass in ci4ms - Severity: High 8.1 - Published: Apr 8, 2026 - Affected: fixed in 0.31.4.0. ### [CVE-2026-39392](https://cve.now/CVE-2026-39392): CI4MS has Stored XSS in Pages Content Due to Missing html\_purify Sanitization - Severity: Medium 5.5 - Published: Apr 8, 2026 - Affected: fixed in 0.31.4.0. ### [CVE-2026-39391](https://cve.now/CVE-2026-39391): CI4MS has Stored XSS via Unescaped Blacklist Note in Admin User List - Severity: Medium 4.8 - Published: Apr 8, 2026 - Affected: fixed in 0.31.4.0. ### [CVE-2026-39390](https://cve.now/CVE-2026-39390): CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting - Severity: Medium 5.5 - Published: Apr 8, 2026 - Affected: fixed in 0.31.4.0. ### [CVE-2026-39389](https://cve.now/CVE-2026-39389): CI4MS has a Hidden Items Authorization Bypass in Fileeditor Allows Reading Secrets and Writing Protected Files - Severity: Medium 6.7 - Published: Apr 8, 2026 - Affected: fixed in 0.31.4.0. ### [CVE-2026-35035](https://cve.now/CVE-2026-35035): CI4MS Company Information Public-Facing Page Full Platform Compromise & Full Account Takeover for All Roles & Privilege-Escalation via… - Severity: High 7.2 - Published: Apr 6, 2026 - Affected: fixed in 0.31.2.0. ### [CVE-2026-34989](https://cve.now/CVE-2026-34989): CI4MS affected by Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.4 - Published: Apr 6, 2026 - Affected: fixed in 31.0.0.0. ### [CVE-2026-34572](https://cve.now/CVE-2026-34572): CI4MS: Account Deactivation Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) - Severity: High 8.8 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34571](https://cve.now/CVE-2026-34571): CI4MS: Stored Cross‑Site Scripting (Stored XSS) in Backend User Management Allows Session Hijacking and Full Administrative Account… - Severity: Critical 10.0 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34570](https://cve.now/CVE-2026-34570): CI4MS: Account Deletion Module Full Persistent Unauthorized Access for All‑Roles via Improper Session Invalidation (Logic Flaw) - Severity: High 8.8 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34569](https://cve.now/CVE-2026-34569): CI4MS: Blogs Categories Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 10.0 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34568](https://cve.now/CVE-2026-34568): CI4MS: Blogs Posts Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34567](https://cve.now/CVE-2026-34567): CI4MS: Blogs Posts (Categories) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34566](https://cve.now/CVE-2026-34566): CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34565](https://cve.now/CVE-2026-34565): CI4MS: Menu Management (Posts) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34564](https://cve.now/CVE-2026-34564): CI4MS: Menu Management (Pages) Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34563](https://cve.now/CVE-2026-34563): CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34562](https://cve.now/CVE-2026-34562): CI4MS: System Settings (Company Information) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via… - Severity: Medium 4.7 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34561](https://cve.now/CVE-2026-34561): CI4MS: System Settings (Social Media Management) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via… - Severity: Medium 4.7 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34560](https://cve.now/CVE-2026-34560): CI4MS: Logs Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34559](https://cve.now/CVE-2026-34559): CI4MS: Blogs Tags Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Apr 1, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34558](https://cve.now/CVE-2026-34558): CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Mar 30, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-34557](https://cve.now/CVE-2026-34557): CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS - Severity: Critical 9.1 - Published: Mar 30, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-27599](https://cve.now/CVE-2026-27599): CI4MS: System Settings (Mail Settings) Full Platform Compromise & Full Account Takeover for All-Roles & Privilege-Escalation via Stored… - Severity: Medium 4.7 - Published: Mar 30, 2026 - Affected: fixed in 0.31.0.0. ### [CVE-2026-25510](https://cve.now/CVE-2026-25510): CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editor - Severity: Critical 10.0 - Published: Feb 3, 2026 - Affected: fixed in 0.28.5.0. ### [CVE-2026-25509](https://cve.now/CVE-2026-25509): CI4MS Vulnerable to User Email Enumeration via Password Reset Flow - Severity: Medium 5.3 - Published: Feb 3, 2026 - Affected: fixed in 0.28.5.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/ci4-cms-erp/ci4ms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.